Supabase allows open sign-up with email auto-confirmation
ShipReady found published Supabase settings showing public sign-up enabled and email auto-confirmation enabled.
Why it matters
When an application relies on an email address as proof of identity, automatically confirming self-registered addresses can undermine that assumption.
How ShipReady detects it
What it inspects
After discovering a Supabase project and public anon key from client content, ShipReady reads the published auth settings document and checks the signup and mailer auto-confirm values.
What triggers a finding
The rule triggers only when the settings report public sign-up enabled and mailer auto-confirm enabled.
What the evidence shows
The observed settings document reports that both public sign-up and email auto-confirmation are enabled.
Limits of this check
ShipReady does not register an account, send email, inspect custom auth hooks, determine how the application treats email verification, or establish what a newly registered user can access. It does not prove account abuse or unauthorized access.
How to fix it
Choose an explicit verification policy
Require email confirmation when the product treats a verified address as meaningful, or document why automatic confirmation is safe for the intended flow.
Protect actions beyond sign-up
Use explicit authorization and appropriate anti-abuse controls for invitations, account recovery, domain claims, and other sensitive workflows.
How to verify the change
Test the real registration workflow
Create controlled accounts with different email ownership states and verify the application grants access only after the intended checks.
Expected: The deployed registration flow enforces the product's intended email-identity policy.