7
Ability to restrict / remove access to values in vault-related tables/views from Supabase Studio UI
Source: supabase/supabase#31300 · opened by @StephenTangCook
The current recommendation for storing secrets in [Supabase vault]( involves storing the data in the "vault"."secrets" table and retrieving it via the automatically generated "vault"."decrypted_secrets" view.
My concern is that every user of our Supabase project has READ access and can immediately see every decrypted secret simply by opening that view or table in the Supabase Studio UI. Yes, I know technically some have access to the secret key via Supabase Studio anyways and could programatically get this info... but the principle is that it is too easy to access, especially for use cases where even the db owners should not be able to view the secrets decrypted.
My request is for the ability to remove access to the vault tables/views for our users in Supabase Studio, or at least have a _<🔒secret>_ -esque placeholder for the decrypted values.
My concern is that every user of our Supabase project has READ access and can immediately see every decrypted secret simply by opening that view or table in the Supabase Studio UI. Yes, I know technically some have access to the secret key via Supabase Studio anyways and could programatically get this info... but the principle is that it is too easy to access, especially for use cases where even the db owners should not be able to view the secrets decrypted.
My request is for the ability to remove access to the vault tables/views for our users in Supabase Studio, or at least have a _<🔒secret>_ -esque placeholder for the decrypted values.
No pledges yet. Be the first to back this.
Comments
Similar requests
Self-Hosted: User Authentication Context and Auditability in Supabase Studio
3 votes · 0 comments
Local supabase studio and supabase dashboard looks too similar.
3 votes · 0 comments
Internationalization (i18n) Architecture for Supabase Studio
1 vote · 0 comments
Edge functions not showing in local Supabase Studio
15 votes · 0 comments
Retrieve list of users by ID
1 vote · 0 comments
No comments yet.