How secure are Supabase Edge Functions?

Supabase Edge Functions run on Deno Deploy and are isolated from your database by default. They can access the database using the service_role key, which means any vulnerability in an edge function could lead to unrestricted database access. Edge functions should validate and sanitize all user input, implement proper authentication checks, and avoid exposing sensitive environment variables in responses. By default, edge functions require a valid JWT in the Authorization header unless verify_jwt is set to false. UNPWNED checks common public function paths for unauthenticated reachability, exposed response data, CORS, rate-limit, and error-disclosure signals. Server-side input validation requires code review or targeted testing.