How Supabase scales security across its application development lifecycle with depthfirst

Supabase provides database infrastructure as a service around Postgres, including authentication, storage, real-time services, and edge functions. Its infrastructure sits underneath its customers’ applications and data.

Security is central to Supabase because millions of projects rely on its databases, authentication, and storage. A weakness in that foundation could put both customer data and the applications built on Supabase at risk. The company manages that responsibility with a lean product and platform security team supporting hundreds of engineers.

Supabase needed security coverage that could extend across more of the development lifecycle without creating bottlenecks for engineering. depthfirst helps Supabase prevent supply chain attacks, secure its code and PRs, and run agentic pentests on demand without slowing down.

When Supabase enrolls a repository, depthfirst devotes hours of agent compute to understanding how the application works. It maps the repository’s components, dependencies, data flows, and authorization paths, and generates an editable threat model to investigate plausible attack paths across the codebase. Findings include the conditions required for exploitation and the evidence showing how an attacker could reach the vulnerable code, giving the security team a prioritized baseline of existing risk without requiring it to reconstruct each issue from scratch.

Supabase keeps its prioritized queue at zero, working through active findings from high severity to low. When several findings point to the same file, line, or underlying cause, the team groups them around the root cause and can resolve multiple related issues through one corrective change.

This helps Supabase stay ahead of its bug bounty program. It recently received HackerOne reports for issues that depthfirst had previously surfaced and the team was already working to fix. Instead of beginning a new investigation, the team could continue the work already underway.

Once the baseline is established, Security Reviewer applies that repository context to every pull request. Findings appear while the change is still fresh, with the evidence and remediation guidance developers need to fix routine issues directly. The security team only steps in for the few findings that require its judgment.

Supabase pentests new applications as part of its release process, but external providers cannot always deliver the availability, reliability, and consistency its release schedule demands.

That constraint recently put a launch at risk. Without depthfirst, Supabase would have had to delay the release or complete a one-day rapid risk assessment and accept the remaining uncertainty. Agentic Pentesting gave the team the coverage it needed to ship on time with confidence.

Supabase also uses Agentic Pentesting to prioritize fixes before urgent launches. In one case, baseline scans across a product’s three repositories produced a significant volume of findings. Agentic Pentesting helped identify which findings appeared exploitable in the deployed service, narrowing the set that required immediate investigation.

Agentic Pentesting has also helped Supabase find critical issues that hadn’t been surfaced by previous pentests. While testing a new product, depthfirst reached an injection vulnerability in an adjacent feature and rated it medium. After tracing its behavior into the backend, Supabase determined that it could lead to code execution, escalated it to critical, and resolved it.

Dependency Firewall reviews packages before installation and blocks those identified as malicious, helping Supabase prevent supply chain attacks. A unique token assigned to each repository lets security trace package requests to their source. To date, Dependency Firewall has analyzed millions of dependencies without unintended interruptions to developers.

Supabase also uses Dependency Firewall to enforce a minimum age for packages, and has blocked multiple packages that did not meet the requirement. Engineers continue using their normal build process, while packages that violate the policy stop for security review.