Private data
The denylist table lives in a dedicated private schema and revokes access from public, anon, and authenticated.
Supabase integration · review first
Supabase disposable email blocker
Reject temporary email signups before Auth creates a user, using a private schema, RLS, least-privilege grants, and an explicit hook migration.
Recommended boundary: Supabase's Before User Created Hook. The generated SQL returns
SIGNUP_EMAIL_NOT_ALLOWED for malformed or default-blockable disposable domains and returns an empty object for allowed signups.Generate a migration
node cli/dist/bin.js init supabase \
--output supabase/migrations/20260827000000_disposable_email_guard.sqlInspect the file before applying it with your normal migration workflow. The command does not read credentials, connect to a project, or run supabase db push.
Security properties
Least privilege
Only supabase_auth_admin receives schema usage, table select, and function execute grants.
Review boundary
SQL is generated locally. Production application remains an explicit operator decision.
What it does not do
It does not block Gmail/Yahoo, probe SMTP, copy another list, or replace rate limiting, CAPTCHA, or email verification. Use a reviewed custom allowlist for false positives.