How to run coding agents safely: permissions, sandboxes and secrets
How to run coding agents safely with Claude Code permission modes, Codex sandbox and approval settings, deny rules, and habits that keep secrets out of reach.
Supabase RLS audit skill for coding agents
An agent skill that checks every Supabase table for Row Level Security and per-operation policies, then reports gaps without changing anything.
Tables in an exposed schema without RLS can be read with your public key. This skill finds them first.
Preview: SKILL.md
---
name: supabase-rls-audit
description: Audits Supabase Row Level Security for every table in exposed schemas, checking RLS is enabled, grants, per-operation policies, with check clauses, auth.uid() usage, views and indexes, then reports gaps and proposes migrations without applying them. Use when the user asks to audit, review or test Supabase RLS, policies, permissions or data access.
compatibility: Requires a Supabase project. Reads migrations in supabase/migrations; optionally uses a read-only database connection or the Supabase MCP server with read_only=true.
metadata:
author: codema
version: "1.0"
---
# Supabase RLS audit
Goal: prove that each user can only reach the rows they should. Read-only. Never run DDL, never disable RLS, and never apply a migration. Propose SQL for a human to review.
## 1. Inventory
1. List tables in exposed schemas (usually `public`). Use migrations in `supabase/migrations/`, or with a read-only connection run:
```sql
select n.nspname as schema, c.relname as table_name, c.relrowsecurity as rls_enabled
from pg_class c join pg_namespace n on n.oid = c.relnamespace
What's inside
- One
SKILL.md, validated against the Agent Skills spec - Reports gaps and proposes migrations, but never applies them
How to use it
- Unzip into
.agents/skills/(Cursor, Codex) or.claude/skills/(Claude Code). - Ask: "audit my Supabase RLS".
- Fix what it flags, then run it again.
Who it's for
Anyone shipping on Supabase.
Related
Keep reading
Keep reading
MCP security best practices: how to use MCP servers without leaking data
MCP security best practices for vibe coders: prompt injection risks, what the MCP spec requires, and a checklist to use MCP servers without leaking data.
Git and GitHub basics for vibe coders: never lose AI-written code
Git and GitHub basics for vibe coders: the commands you need, a branch-per-task workflow for coding agents, .gitignore for secrets, and push protection.
Newsletter
The Codema publication. Consent is required. You are not subscribed until you confirm from the email, and nothing is stored if email delivery is not connected.