Policy always evaluates to true

What the finding looks like

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by RowShield. Review before running in production.
-- Policy 'public_read' grants every row on public.invoices to: anon, authenticated.
-- Replace it with an owner-scoped equivalent:

DROP POLICY public_read ON public.invoices;

CREATE POLICY public_read
  ON public.invoices
  FOR SELECT
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

Related guides

• USING (true): the policy that protects nothing
• Policies scoped to service_role are decoration
• RESTRICTIVE policies: the modifier people accidentally grant with
• The Supabase security gaps Lovable apps ship with
• The dashboard says protected, but the table is still readable
• Tautological policies: when RLS is switched on and says nothing
• Prevent Supabase RLS bypass
• Audit the Supabase policies Cursor wrote
• Detect Supabase schema drift after migrations
• What the Supabase Security Advisor does not do
• Continuous RLS monitoring for Supabase

What people search for