Supabase describes its Edge Functions as server-side TypeScript functions distributed globally at the edge, close to your users. Cloudflare Workers and Vercel's functions offer the same idea. For an app built with an AI tool, the edge function is usually the only real backend you have: it is where the Stripe secret key, the OpenAI key and the privileged database key are meant to live.
Because it runs on a server, code inside an edge function can safely hold secrets. But the function itself has a public URL, and anyone on the internet can call it. The common mistake in generated code is a function that does something powerful, such as sending email, charging a card or reading any user's data with an admin key, without first checking who is calling. Some setups also switch off the platform's built-in token check so a webhook can reach the function, then never add another check in its place.
For every function, decide who may call it and enforce that in the first lines: verify the user's token, or verify the webhook signature, or require a shared secret. Read the user's identity from the verified token, never from the request body. Store keys as function secrets, not in the code, and return only the data the caller needs.
const { data: { user } } = await supabase.auth.getUser(token);
if (!user) {
return new Response("Unauthorized", { status: 401 });
}