Secure Supabase Auth with Claude Code: A Security Checklist and Acceptance Test Workflow

Workflow value: 85/100
Status: active · Freshness: 70/100 · Confidence: 0.95 · Level: intermediate
Categories: Quality Control, Context & Memory, Debugging, Shipping, CLAUDE.md
Original source: r/ClaudeCode post/comment

What problem this solves

Prevents common security vulnerabilities in Supabase authentication when code is generated by AI agents, especially issues that might not be apparent during development environments.

Summary

A security checklist and acceptance criteria for guiding Claude Code to generate secure Supabase authentication patterns, preventing common vulnerabilities often overlooked in agent-generated code that appears functional in development.

Why it is useful

This workflow provides a critical, actionable framework for ensuring AI-generated code adheres to essential security best practices for Supabase authentication. It moves beyond vague instructions by offering specific rules and a concrete validation method, directly addressing a common pitfall where insecure code might appear functional during development. This helps users prevent significant security vulnerabilities in their projects.

Workflow

1. Define explicit security rules for Supabase auth within the project instructions or an 'auth contract'.
2. Instruct Claude Code to never authorize based on user_metadata.
3. Ensure roles and permissions are derived from app_metadata, a server-side table, or a verified server-side claim.
4. Verify that the Supabase service role key is strictly server-only and never exposed in client components, browser bundles, logs, or public environment variables.
5. Ensure client-side code uses the anon key in conjunction with Row Level Security (RLS).
6. Route all privileged operations through server routes or functions that include explicit security checks.
7. Confirm that every database table has RLS enabled before considering feature work complete.
8. Add a negative test case to verify that a normal user cannot promote themselves or access administrative paths.
9. Include an acceptance check prompt for Claude Code, such as: "Show where authorization happens, prove the role source is server-controlled, prove the service key cannot reach the client, and show the negative test."
10. Iterate with Claude Code until all acceptance criteria are met.

Tools / artifacts

• Supabase auth
• user_metadata
• app_metadata
• Service role key
• Anon key
• RLS (Row Level Security)
• Server routes/functions
• Negative test
• Project instructions/Auth contract

Validation signals

• Explicitly states 'the bad version often works in dev', indicating real-world problem identification.
• Provides a concrete 'example acceptance check' for verification.
• The heuristic stage identified 'validation:4'.

Limitations

• Requires the user to have a foundational understanding of Supabase security concepts.
• The 'project instructions' and 'auth contract' are conceptual; a concrete template or example of how to structure these for Claude would enhance the workflow.
• While providing clear instructions, it still relies on careful prompt engineering and human oversight to ensure Claude fully adheres to the security contract.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.