Supabase REST protection

Preserve RLS. Protect the response too.

Row-level security decides which rows a JWT may see. Safe Boundary adds a routed HTTP layer that masks configured columns and stops PostgREST filters from inferring protected values.

Get early access
Review the security model →

Why this exists

Row access and value exposure are different decisions

The filter forwards Authorization and apikey headers so Supabase still selects the database role and applies RLS. It maps selected fields to the catalog and masks JSON or CSV after PostgREST responds.

For protected fields, the inference guard can block ordering, ranges, pattern matching, full-text search, and aggregation while allowing equality-style operations according to policy.

What it does

Concrete controls, stated precisely.

01

JWT passthrough

Supabase remains authoritative for request authentication, role selection, and row-level security.

02

Typed response masking

JSON and CSV fields map to catalog columns; masked UUIDs, numbers, booleans, and strings retain compatible shapes.

03

Inference guard

Leaky operations on a masked field are blocked from the parsed request, including supported embedded-resource filters.

How it works

A visible enforcement sequence.

  1. 1

    Front

    Deploy the filter as the REST base URL used by the client.

  2. 2

    Forward

    Pass JWT and apikey headers unchanged to PostgREST.

  3. 3

    Analyze

    Map selected fields and filters to the live PostgreSQL catalog.

  4. 4

    Mask or block

    Transform supported responses or refuse unsafe inference paths.

Protected when

  • ✓PostgREST requests routed through the filter
  • ✓Supported JSON and CSV representations of configured columns
  • ✓Known inference operators on protected fields

Important boundaries

  • —Direct use of the original Supabase REST URL bypasses the filter
  • —The filter complements RLS; it does not repair overly broad RLS or service_role access
  • —Realtime, Storage, Edge Functions, GraphQL, and other endpoints are separate paths

Continue the story

Related Safe Boundary pages

Inference protection →

See why masking alone cannot stop value extraction.

Schema-aware masking →

Configure which columns are protected and preserve compatible response types.

Security model →

Understand trust boundaries, credentials, identity, and bypass conditions.

Test the boundary on a real access path.

Start in observe mode, validate the policy against representative traffic, and move to enforcement with explicit bypass controls.

Get early access