lw15 d3b2 (supabase#37211)

* chore: blog post

* add author, og and thumb

* chore: update screenshots

* fix: crop and authors

* rss

* updates

---------

Co-authored-by: Francesco Sansalvadore <[email protected]>
Co-authored-by: Wen Bo Xie <[email protected]>

Author: 3 people

apps/www/_blog/2025-07-16-improved-security-controls.mdx

@@ -0,0 +1,130 @@
+---
+title: 'Improved Security Controls and A New Home for Security'
+description: 'Access to a new central security page and launch of additional controls.'
+categories:
+  - product
+  - launch-week
+tags:
+  - launch-week
+  - security
+  - realtime
+date: '2025-07-16:15:00'
+toc_depth: 3
+author: staaldraad,hieu,filipe
+image: launch-week-15/day-3-security-controls/og.jpg
+thumb: launch-week-15/day-3-security-controls/thumb.png
+launchweek: 15
+---
+
+Today we are launching the foundations of several security features we plan to build on in the upcoming months.
+
+- Centralized security docs
+- Organization‑wide security settings in the Dashboard
+
+## Centralized Security Docs
+
+Supabase offers a robust set of security controls, but discovering and configuring them can feel daunting. Our [new security documentation](/docs/guides/security) brings everything into one place - from product features like Auth Rate Limits and Vault to step‑by‑step guides on building secure applications with Supabase (Row‑Level Security, hardening the Data API, the Production Checklist, and more).
+
+We’ve also published dedicated [SOC 2](/docs/guides/security/soc-2-compliance) and [HIPAA](/docs/guides/security/hipaa-compliance) guides that explain how to achieve these compliance standards on Supabase and answer common questions.
+
+## Enforce MFA in Organization Security Settings
+
+<Img
+  src={{
+    dark: '/images/blog/launch-week-15/day-3-security-controls/mfa-enforced-dark.png',
+    light: '/images/blog/launch-week-15/day-3-security-controls/mfa-enforced-light.png',
+  }}
+  alt="Organization view with a MFA enforced project"
+/>
+
+The first setting we are launching in the organization‑wide security settings page in the Dashboard is the ability to enforce Multi‑Factor Authentication (MFA) for every member of a Supabase Organization. Once enabled, all members must have MFA configured to access any project or resource in that org.
+
+<Img
+  src={{
+    dark: '/images/blog/launch-week-15/day-3-security-controls/mfa-enforced-project-dark.png',
+    light: '/images/blog/launch-week-15/day-3-security-controls/mfa-enforced-project-light.png',
+  }}
+  alt="Project view when MFA enforced and access denied"
+/>
+
+With MFA enforcement enabled, all members of your organization must use multi-factor authentication to access any project or resource. If a member hasn’t enabled MFA, they will immediately lose access until they do. New organization members will be able to accept invitations to an MFA enforced organization, but will not be able to interact with the organization until they have enabled MFA.
+
+This setting is only available to **Organization Owners**, and the owner must have MFA enabled on their own account. We recommend setting up **two separate MFA apps** as a backup.
+
+A few notes:
+
+- Only available on **Pro, Team, and Enterprise** plans.
+- **Personal Access Tokens** (**PATs**) are not affected by this setting.
+
+You can toggle on this setting in the new [**Security tab**](/dashboard/org/_/security) of your organization settings.
+
+<Img
+  src={{
+    dark: '/images/blog/launch-week-15/day-3-security-controls/security-page-dark.png',
+    light: '/images/blog/launch-week-15/day-3-security-controls/security-page-light.png',
+  }}
+  alt="New security tab under organization settings"
+/>
+
+## Supabase Realtime - Enable Private Channels Only
+
+<Img
+  src={{
+    dark: '/images/blog/launch-week-15/day-3-security-controls/realtime-settings-dark.png',
+    light: '/images/blog/launch-week-15/day-3-security-controls/realtime-settings-light.png',
+  }}
+  alt="Realtime configuration for private channels"
+/>
+
+You can now set Realtime to use only private channels using [Realtime Authorization](/docs/guides/realtime/authorization?queryGroups=language&language=dart). If you toggle off the `Allow public access` setting, no public channels can be created. Only clients authorized via [Realtime Authorization](/docs/guides/realtime/authorization?queryGroups=language&language=dart), can listen to and send messages.
+
+This settings page is under a feature preview and you can enable it [here](/dashboard/project/_?featurePreviewModal=supabase-ui-realtime-settings). Once the feature preview is enabled, you can configure this setting in the new [Realtime Settings page](/dashboard/project/_/realtime/settings). While you are there, you can also tune the connection pool size that Realtime uses and the maximum **concurrent clients.**
+
+## Security and Performance Advisors - Disable Specific Rules
+
+<Img
+  src={{
+    dark: '/images/blog/launch-week-15/day-3-security-controls/security-advisor-rules-dark.png',
+    light: '/images/blog/launch-week-15/day-3-security-controls/security-advisor-rules-light.png',
+  }}
+  alt="Security and Performance Advisors - Rules Overview"
+/>
+
+We received feedback from users that not all security and performance advisor rules apply to their project. Supabase powers everything from backend‑only APIs to full‑stack apps and some Security and Performance advisors may not be applicable for everyone. For example, the RLS Disabled in Public rule may not apply if you only access Supabase from a secure context like a web server.
+
+<Img
+  src={{
+    dark: '/images/blog/launch-week-15/day-3-security-controls/security-advisor-individual-rule-dark.png',
+    light:
+      '/images/blog/launch-week-15/day-3-security-controls/security-advisor-individual-rule-light.png',
+  }}
+  alt="Security and Performance Advisors - Disable Rule"
+/>
+
+You can now customize Security Advisor rules and disable rules which are not relevant to your project. We will be extending rule customization to include rule assignment and more fine grained filtering.
+
+This is currently under a feature preview and you can enable it [here](/dashboard/project/_?featurePreviewModal=supabase-ui-advisor-rules). Once enabled, rules can be managed through the new [configuration section](/dashboard/project/_/advisors/rules/security).
+
+## What comes next?
+
+This release is the first building block in our security roadmap across the Supabase platform, including user auth, network isolation, compliance tooling, and automated remediation.
+
+Here’s what's in progress:
+
+**Stronger Authentication and Access Control**
+
+- **YubiKey and hardware key MFA support** to complement Time-based One-Time Password (TOTP) flow.
+- We have already announced that [project scoped roles](/docs/guides/platform/access-control#organization-scoped-roles-vs-project-scoped-roles) are [available on the Team plan](/changelog#project-scoped-roles), and now we are working to bring **custom roles** to our Enterprise plan. This will allow organizations to define custom, fine grained roles, limiting the actions and resources users have access to.
+
+**Security Enforcement**
+
+- **Assigning Security Advisories** to team members in your org.
+- Furthermore, we are extending our project scoped controls to allow **automatically enforcing compliance controls** on [sensitive projects](/docs/guides/platform/hipaa-projects).
+- Supporting **additional compliance standards**, alongside our existing [SOC 2](/docs/guides/security/soc-2-compliance) and [HIPAA](/docs/guides/security/hipaa-compliance) controls.
+
+**Enterprise Connectivity**
+
+- **Self-service SSO for Supabase Organizations:** Enterprise teams looking to enforce SSO sign-on will be able to self-serve via Supabase Dashboard and will no longer need to submit a support ticket.
+- [Supabase PrivateLink](/docs/guides/platform/privatelink) provides enterprise-grade private network connectivity between your AWS VPC and your Supabase database using AWS VPC Lattice. This is currently in Private Alpha and available to our Enterprise customers.
+
+Our goal is to provide you with the best suite of security tools you need to deploy your production apps on Supabase with confidence.

apps/www/components/LaunchWeek/15/data/lw15_build_stage.tsx

@@ -65,13 +65,13 @@ export const days: BuildDay[] = [
     ],
   },
   {
-    title: '',
+    title: 'Improved Security Controls and A New Home for Security',
     description: '',
-    id: '',
-    is_shipped: false,
+    id: 'security-homepage',
+    is_shipped: true,
     links: [
       {
-        url: '/blog/',
+        url: '/blog/improved-security-controls',
         label: 'Blog post',
         target: '_blank',
       },

apps/www/lib/authors.json

@@ -645,5 +645,13 @@
     "position": "Engineering",
     "author_url": "https://github.com/jose-ledesma",
     "author_image_url": "https://avatars.githubusercontent.com/u/52402874?v=4"
+  },
+  {
+    "author_id": "staaldraad",
+    "author": "Etienne Stalmans",
+    "username": "staaldraad",
+    "position": "Security Engineer",
+    "author_url": "https://github.com/staaldraad",
+    "author_image_url": "https://avatars.githubusercontent.com/u/4200832?v=4"
   }
 ]