Hello,
We are preparing a production security release for a hosted Supabase project.
Our security audit is complete and all local rehearsals pass.
The only remaining blocker concerns future default privileges owned by the internal supabase_admin role.
We verified that the hosted postgres role cannot execute:
SET ROLE supabase_admin; -- ERROR: 42501
ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin ...; -- ERROR: 42501
We understand that supabase_admin is a platform-managed role and that hosted postgres is not a PostgreSQL superuser.
Our question is:
What is the officially supported way to guarantee secure default privileges for future objects in a hosted Supabase project?
Specifically:
Is there a supported mechanism (Dashboard, CLI, migration, API, or support-assisted process) that executes as the real supabase_admin?
Or is the recommended model simply:
postgres,The user is seeking guidance on securing default privileges for future objects in a hosted Supabase project. They are unable to alter default privileges using the supabase_admin role and are looking for an officially supported method to ensure security without unsupported role escalation.
supabase_admin default ACLs because they are platform-managed?We are intentionally avoiding unsupported role escalation or managed-schema modifications.
Any official guidance would be appreciated.
Thank you.