​
Overview

The Supabase integration provides comprehensive monitoring of your Supabase projects, including database security policies, user access, storage configurations, edge functions, and security analysis. LowerPlane syncs project data to evaluate security posture and support access reviews.

​
Authentication

Supabase uses OAuth 2.0 for authentication. When you connect, you’ll be redirected to Supabase to authorize LowerPlane.

​
Required Permissions (OAuth Scopes)

​
What LowerPlane Collects

Project Info

Project metadata, region, status, and configuration

Organization Members

Member list with roles for access reviews and offboarding checks

Database Users

Database-level user accounts and authentication methods

Row-Level Security

RLS policies on all tables for data access governance

Edge Functions

Serverless function inventory and deployment status

Storage Buckets

Storage bucket configurations and access policies

​
Security Analysis

LowerPlane performs automated security analysis of your Supabase projects, checking for:
  • Tables without Row-Level Security (RLS) enabled
  • Publicly accessible storage buckets
  • Database users with excessive privileges
  • Missing authentication requirements on edge functions
  • Exposed API keys or service role misconfigurations

​
Critical System Access

Supabase is automatically registered as a critical system in your access review program. Both organization members and database users are synced for:
  • Periodic user access reviews
  • Offboarded employee detection
  • Role-based access monitoring

​
Security Tests

​
Sync Frequency

Supabase data syncs based on your configured schedule (default: daily). Each sync collects project configurations, member lists, database policies, and storage settings.