RLS enabled but no policies

What the finding looks like

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by RowShield. Review before running in production.
-- RLS is already enabled on public.invoices;
-- it has no policies, so every row is denied. Add the access you intend:

CREATE POLICY invoices_select_own
  ON public.invoices
  FOR SELECT
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_insert_own
  ON public.invoices
  FOR INSERT
  TO authenticated
  WITH CHECK (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_update_own
  ON public.invoices
  FOR UPDATE
  TO authenticated
  USING (user_id = (SELECT auth.uid()))
  WITH CHECK (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_delete_own
  ON public.invoices
  FOR DELETE
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

Related guides

• RLS enabled, zero policies: silently everything-denied
• The Supabase security gaps Lovable apps ship with
• Bolt.new builds and the policies that were never written
• Claude Code + Supabase MCP: fast schema, slow policy
• The migration that recreated the table without its policies
• Prevent Supabase RLS bypass
• Bolt.new shipped tables without RLS
• Detect Supabase schema drift after migrations
• What the Supabase Security Advisor does not do
• Continuous RLS monitoring for Supabase

What people search for