// Decision comparison
Firebase vs Supabase: security for AI-built apps
Quick answer
Firebase and Supabase solve the same problem (a backend for an app that talks straight from the browser) and share the same single point of failure: the access rule. On Supabase it is RLS (Row Level Security) per table; on Firebase it is the Firestore/Storage Security Rules. In both, the champion hole is the open rule: RLS off on one side, allow read, write: if true on the other. The result is identical, a public database via a key that sits in the client.
The public key (anon_key on Supabase, apiKey on Firebase) is NOT the secret; it is meant to live in the frontend. The real protection is the rule. Pick on the ecosystem (SQL vs NoSQL, Postgres vs Firestore); rule discipline is mandatory in both.
Same hole, different names
The mental model is the same; the syntax and where you lock it change:
| Concept | Supabase | Firebase |
|---|---|---|
| Protection layer | RLS per table | Security Rules (Firestore/Storage) |
| Key in the client | anon_key (public) | apiKey (public) |
| Champion hole | RLS off | Rule allow if true |
| Owner check | policy with auth.uid() | request.auth.uid |
| File leak | Public Storage bucket | Storage bucket without a rule |
What to review in each
On Supabase, test what the anon_key reaches without login and check RLS + policy with auth.uid() table by table. On Firebase, read the Security Rules collection by collection, hunting for if true and missing request.auth.uid, and test an unauthenticated request. The Promptbook covers both; serious signals go to Risk Review.
Frequently asked questions
Which is more secure by default?
Both start permissive enough to leak if you do not lock the rule. There is no "more secure by default" here; there is "rule locked correctly". The model is equivalent: RLS on Supabase, Security Rules on Firebase.
Do I need to hide the anon_key / apiKey?
No, both are public by design and live in the client. What protects the data is the rule (RLS or Security Rules). Hiding the key does not help if the rule is open, and is not needed if the rule is correct.
Who runs the review at RET?
Gabriel Lima Ferreira, founder and lead pentester, with authorization and a tight scope.