Connecting Supabase

Connect a Supabase organization with an access token and MiraShield checks every project in it, nightly: whether the database refuses unencrypted connections, whether it accepts connections from any address, and (on paid plans) whether point-in-time recovery is on. It only reads. Your token is checked against Supabase before anything is saved, then stored encrypted and never shown again.

What you need from Supabase

• A personal access token: in Supabase, open your account, then Access Tokens, and generate one. If Supabase lets you choose permissions, pick read-only access to Organizations, Projects, Database (SSL enforcement and backups) and Network Restrictions on this organization. If it does not, Supabase offers nothing narrower than a token with your account's full access; MiraShield only reads with it.
• Your organization's slug: open the organization, then Settings, then General, and copy the Organization slug.

How to set it up

1. Open Settings, then Connectors, and click "Add a connector".
2. Pick "Supabase".
3. Paste the token and the organization slug, then click "Connect Supabase". If either is wrong, it says so and saves nothing.
4. Run Scan now, or wait for the nightly scan.

What it checks

• SSL enforcement is off (high): the database accepts unencrypted connections. Fix it in the project's Settings, then Database, with "Enforce SSL on incoming connections". Make sure your app's connection string uses SSL first, or it will stop connecting.
• No network restrictions (medium): the database accepts connections from any address. Restrict it in the project's Settings, then Database, under Network Restrictions.
• Point-in-time recovery is off (medium): only checked on paid plans, because the Free plan does not offer it.

Paused projects are not asked anything, and anything MiraShield could not read is reported as unknown instead of passing. Preview branches are judged through their parent project.