What are the security best practices for Supabase?

Enable RLS on every exposed table and write specific policies that match your application logic. Never expose the service_role key in client-side code and use it only in secure server environments. Enable email confirmation for authentication and configure proper password requirements. Use pgAudit or Supabase logs to monitor for suspicious database activity. Keep your Supabase project updated, restrict network access where possible, and enable two-factor authentication on your Supabase dashboard account. Scheduled UNPWNED scans can alert paid users when externally observable findings change, but they do not replace direct policy and log review.