Checks · AUTH-003

AUTH-003 · Supabase user_metadata used for roles

Why it matters

Users can edit their own user_metadata. A role stored there is chosen by the user.

How we detect it

Code reads role from user_metadata.

How we fix it

Store roles in app_metadata or a roles table that users cannot write.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-004 · Email confirmation disabled with paid features