Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
- Key takeaways
- What attack - protection features does Supabase provide?
- How do I add CAPTCHA to stop bots and abuse?
- How can I limit the rate of authentication requests?
- How do I forward the real client IP when behind a reverse proxy?
- What is the fail2ban - style protection and how does it work?
- How can I prevent users from choosing leaked passwords?
- How do I enforce Multi - Factor Authentication for all users?
- How do I add custom logic to auth events?
- How is DDoS mitigation handled?
- How can I verify my Supabase configuration is not leaking secrets?
- Quick checklist to harden Supabase Auth
Key takeaways
- Enable CAPTCHA (hCaptcha or Cloudflare Turnstile) on sign - up, sign - in and password - reset.
- Turn on leaked - password detection (Pro plan) to block breached passwords.
- Require MFA for all users.
- Review and tighten per - endpoint rate limits; lower the default 30 req/h if needed.
- Use IP - address forwarding when behind a reverse proxy.
- Add custom auth hooks for extra throttling or alerts.
- Verify Cloudflare DDoS protection and fail2ban are active.
- Run a Decloak free scan to confirm no public service_role key or open tables are exposed.
What attack - protection features does Supabase provide?
Supabase bundles several layers of protection directly into its Auth service, so you can defend against bots, credential stuffing, leaked passwords and DDoS without third - party tools. Each feature is configurable from the dashboard or via the Management API.
How do I add CAPTCHA to stop bots and abuse?
Enable the CAPTCHA toggle in Dashboard → Auth → Bot and Abuse Protection and choose hCaptcha or Cloudflare Turnstile. The token is verified server - side before any sign - up, sign - in or password - reset request is processed, blocking automated scripts.
How can I limit the rate of authentication requests?
Supabase uses a token - bucket algorithm per IP address. The default bucket allows 30 requests in a burst and refills at 30 requests per hour for anonymous sign - up. Adjust the bucket capacity and refill rate for each endpoint in Dashboard → Authentication → Rate Limits. Lower the limits if your traffic volume is low to make credential - stuffing attacks harder.
How do I forward the real client IP when behind a reverse proxy?
Set the Sb-Forwarded-For header to the client’s IP and include a secret API key (publishable keys are not accepted). Then enable IP Address Forwarding under Authentication → Rate Limits → IP Address Forwarding or via the Management API (security_sb_forwarded_for_enabled). This ensures the rate - limiter sees the true source IP.
What is the fail2ban - style protection and how does it work?
Supabase Auth runs a daemon that temporarily bans an IP after repeated failed login attempts. It works together with the token - bucket limiter to stop credential - stuffing. The feature is always on and does not require additional configuration.
How can I prevent users from choosing leaked passwords?
On a Pro plan or higher, turn on Prevent use of leaked passwords in Authentication → Passwords. Supabase checks the first five SHA - 1 characters of the password against the HaveIBeenPwned API using k - anonymity and rejects any match.
How do I enforce Multi - Factor Authentication for all users?
Navigate to Dashboard → Authentication → MFA and enable “Require MFA for all users”. Users can enroll TOTP or WebAuthn factors, adding a second verification step after the password.
How do I add custom logic to auth events?
Create server - side PostgreSQL functions and register them as Auth Hooks (e.g., before_sign_in). Hooks run unauthenticated, so they must be defensive. Use them to enforce extra throttling, send alerts, or integrate with external monitoring systems.
How is DDoS mitigation handled?
Supabase fronts the Auth API with Cloudflare CDN, which provides edge caching, IP reputation checks and additional fail2ban rules. Ensure the Cloudflare integration is active in the Security overview page.
How can I verify my Supabase configuration is not leaking secrets?
Run a free Decloak scan on your site URL. The free scan checks the HTTP/TLS posture, static HTML, rendered - page network behaviour and JavaScript CVE patterns, and the vibe - coded platform security layer will flag any publicly readable Supabase tables or an exposed service_role key. The report is graded and shareable within about 15 seconds.
Quick checklist to harden Supabase Auth
- Enable CAPTCHA on sign - up, sign - in and password - reset.
- Turn on leaked - password detection (Pro plan).
- Require MFA for all users.
- Review per - endpoint rate limits and lower them if appropriate.
- Enable IP - address forwarding when using a reverse proxy.
- Add custom Auth Hooks for additional throttling or alerts.
- Confirm Cloudflare DDoS protection and fail2ban are active.
- Run a Decloak free scan to ensure no public service_role key or open tables remain.
For more details on Decloak’s free scan capabilities, see the free scan overview.
Related guides
What is NIST in cybersecurity and why should you care?
NIST is the U.S. agency that creates the Cybersecurity Framework and a suite of standards like SP 800 - 53 that guide risk management for both government and private organizations.
Which NIST Cybersecurity Standards Should My Organization Adopt in 2024 - 2025?
Learn the core NIST publications that form a practical, layered security program, how they map together, and concrete steps to start using them today.
Does the EU AI Act apply to U.S. companies?
Yes - the EU AI Act has extraterritorial reach and can bind U.S. AI providers, deployers, importers or distributors whenever their systems are placed on the EU market, used by an EU entity, or produce output that is used in the Union.