This document describes security configurations that must be set in the Supabase Dashboard (not via SQL migrations).

Leaked password protection checks user passwords against known data breaches to prevent the use of compromised credentials. This is an important security feature for production environments.

• Lint Warning: users_leaked_password_protection on auth.users
• Fix Location: Supabase Dashboard (not SQL migration)

1. Go to Supabase Dashboard → Authentication → Settings
2. Scroll to Security section
3. Find Leaked password protection
4. Turn ON (recommended level: "Medium" or "High" for production)

• Supabase Auth Security Settings
• Have I Been Pwned Integration

• Consider enabling TOTP for admin users
• Available in: Auth → Settings → MFA

• Configure appropriate rate limits for your traffic patterns
• Available in: Auth → Rate Limits

• Review session timeout settings
• Available in: Auth → Sessions

• Consider requiring email confirmation for production
• Available in: Auth → Providers → Email

Last Updated: 2025-11-26
Related: docs/db-lint/README.md - DB lint documentation