Guides

A table in the public schema with Row Level Security switched off returns every row to anyone holding your anon key. Here is the check, the fix, and how to keep it fixed.

Generated migrations create tables in seconds and policies never. Find every public table shipped without Row Level Security, with the enable-and-policy SQL ready.

RLS enabled, dashboard satisfied, every row public. Constant-true policies are the quietest Supabase leak. Here is how to find and replace them.

A write policy with a constant-true WITH CHECK turns your table into a public message board. Find open write paths and close them with scoped CHECK clauses.

A missing WITH CHECK is not stricter than a loose one — Postgres falls back in surprising ways. Find INSERT policies that constrain nothing.

The safe-looking state that quietly breaks your app: RLS switched on, no policies behind it, every non-owner query returns empty. Detect and resolve it.

service_role carries BYPASSRLS, so policies targeting it bind nobody. Why the dashboard generates them anyway, and what to write instead.

A RESTRICTIVE policy can only narrow access, never widen it. Misreading it leaves tables looking locked that are wide open — or the reverse.

RLS never binds the table owner unless you force it — and migrations run as the owner. The one-line fix and why generated policies omit it.

When auth.uid() evaluates to null — cron jobs, triggers, service calls — equality policies deny rather than error. Diagnose null-context failures.

Adding a second permissive policy widens access instead of tightening it. How Postgres combines policies, the classic accidental-widening traps, and the audit query.

Definer functions without a pinned search_path can be hijacked by schema objects in the caller-controlled path. The pin pattern and the audit query.

Table and routine GRANTs shape what PostgREST exposes independently of policies. Audit the grant matrix before it contradicts your policy design.

Pre-15-style views run as their owner, so policies on underlying tables never apply. Find them, convert them, and know what RowShield covers.

Lovable gets a working backend in an afternoon; policies are the step that comes after. The gaps these apps ship with, the requests that reveal them, the fixes.

A table in a Lovable build returns rows to anyone holding the anon key. Here is the single request that proves it, why dashboards still say protected, and the fix.

Bolt scaffolds tables fast; CREATE POLICY lines rarely follow. Why enabled-but-policyless tables happen, the quiet deny-all they cause, and the policies to write.

Cursor writes the CREATE TABLE and skips the ENABLE ROW LEVEL SECURITY line beneath it. How to review AI-generated migrations for the statements that decide exposure.

The Supabase MCP lets Claude Code apply schema changes in seconds while policy work lags behind. What drifts between sessions, the alerts that catch it, how to check.

A Replit frontend ships the Supabase anon key to every visitor. What that key reaches before policies exist, how to test it yourself, and how to bound it properly.

A v0 prototype with a real Supabase project behind it needs a short list of checks before real users arrive. The checklist, the SQL behind each item, the limits.

Firestore rules and Postgres RLS solve the same problem in different grammar. A translation guide for teams moving from Firebase to Supabase, with worked policies.

Edge functions are the right home for service_role — usually. How the boundary fails in practice, how to verify yours holds, and the rotation order when it does not.

One environment variable decides whether Next.js visitors hold an anon key or an RLS-bypassing service_role key. Where the split breaks, and how to prove yours right.

FlutterFlow tutorials end at the API call; the policy half decides who reads what. The RLS work tutorials omit, with the catalog checks and policy SQL to do it properly.

Retool and Bubble connect straight to PostgREST, and the anon key decides what they see. Why internal tools leak, the request that tests it, and what finally bounds it.

Your users or profiles table answers strangers with its contents. The one request that proves it, why dashboards still say protected, and the policy that closes it.

Rows arrive from your REST endpoint with no session and no token beyond the public anon key. Why PostgREST answers, what each response shape means, and the fix.

RLS reads enabled, indicators look green, yet an unauthenticated request returns rows. The tautological policy behind it, and the queries that expose it.

Objects in a public bucket download from their URL with no auth check, and paths circulate. What public really serves, how to verify it, and the signed-URL fix.

The bucket flag says private, yet objects download anyway. A permissive policy on storage.objects grants what the flag withheld — here is the query and the rewrite.

Row Level Security evaluates its predicate against every candidate row, and an unindexed column turns each query into a sequential scan. The diagnosis, and one index.

Compute costs climb after policies land when predicates force sequential scans and bare auth.uid() runs per row. Both habits, the SQL to find them, and the fixes.

You dismissed it, fixed it, watched it clear — and it returned. Why point-in-time checks meet regressing states, and how transition tracking ends the loop.

Fixed Monday, back Friday, nobody touched it. That is a regression — a process restoring yesterday. Where fixes get undone, how to prove it, and what labels it.

What feeds the health score, what moves it, and what it deliberately ignores — described qualitatively, with a query to count the raw inputs yourself.

Tables, policies, buckets and functions move after deploy. A field guide to Supabase schema drift, the failures it causes, and how continuous diffing catches it.

Adding a column can widen what existing policies expose or break their assumptions entirely. How schema additions interact with RLS, and how to catch the fallout.

Rename user_id to owner_id and every policy referencing user_id stops resolving - erroring loudly or comparing against nothing. Failure modes and the fix loop.

Drop-and-recreate is the fastest way to change a table and the fastest way to lose every policy on it. Why it happens, the damage pattern, and the guard.

Point-in-time recovery rewinds data, schema and policies together. Last month’s fixed vulnerability comes back with your data. Plan for it.

"It works in staging" assumes the catalogs match. They rarely do - and the differences concentrate exactly where security decisions live.

The dashboard advisor answers "what is wrong right now". Drift detection answers "what changed since last time". Both matter; neither substitutes.

What each drift alert carries: the object that moved, the transition type, before-and-after context, severity mapping, and the remediation path when one exists.

An RLS policy filtering on an unindexed column turns every query into a sequential scan. Find the columns yourself, then fix each with one statement.

A bare auth.uid() inside a policy is evaluated once per candidate row. Wrapped in a scalar subquery it runs once per statement, with identical semantics.

Row Level Security adds work to every query, and the work compounds as tables grow. These are the policy patterns that stay fast past a million rows — reviewed by hand.

Policy conditions are not run once per query. Here is the per-row evaluation model, what an InitPlan changes, and how to read a plan without inventing numbers.

Nearly every Supabase schema filters each table by an org_id or user id. Getting the index shape right is the difference between a seek and a scan on every request.

You do not need a dashboard to reason about what an unindexed policy costs. A rough model of rows scanned and requests made gets you close, qualitatively and honestly.

Public buckets, open object policies and disabled RLS on storage.objects account for most storage incidents. Walk the checklist, then keep it checked continuously.

Both models are legitimate; they answer different questions. Weigh exposure, expiry, revocation and caching per bucket, then keep whichever you choose monitored.

The anon key is public by design and harmless while RLS bounds it. Here is what it reaches when policies are missing — table by table, surface by surface.

One Supabase key is meant to be public, the other must never leave the server. Anchor the distinction once — including where authenticated users fit — and stop guessing.

A service_role key outside your server is an RLS bypass in someone else's hands. Rotate immediately, inventory what breaks, then move the callers server-side for good.

Supabase has been moving from JWT-shaped keys to explicit publishable and secret formats. What changes, what stays true, and how to migrate your environment variables.

Running Auth0, Clerk or another provider in front of Supabase? Policies still bind everything. Two integration shapes exist, each with familiar, fixable traps.

Postgres change streams honour your RLS policies; broadcast and presence never touch the database. Know which half of Realtime each security rule governs.

A practical security pass for the Supabase project behind your first paying customers: what to lock down this week, and what can wait until revenue lands.

Run Supabase security across many client builds without a platform team: per-project baselines, tiered thresholds and monitoring that survives staff turnover.

The pre-launch pass that separates a weekend prototype from a production Supabase backend: RLS forced on every table, keys scoped, buckets deliberate, backups proven.

Isolation requirements for health data on Supabase: relationship-scoped RLS on clinical tables, private document storage, and configuration watching over time.

Enrolment tables, guardian access and pupil records: how education platforms on Supabase scope student data so one class structurally cannot read another.

Internal tools share the same public URL and anon key as your app. How world-readable ticket tables happen, and how RowShield’s anonymous probe catches them.

Organisation-scoped RLS done properly on Supabase: membership joins, owner overrides, shared-row exceptions, and the conventions that keep a growing schema legible.

A repeatable test for whether tenant A can read tenant B: forged JWT claims, SET ROLE, plus the anonymous probe behind RowShield rule ANON_TABLE_READABLE.

Public posts are meant to be public; profiles, private messages and moderation notes are not. A posture pass for community forums running on Supabase.

Conversation history is the most sensitive table in an AI product. Scope it per user on Supabase, keep writes server-side, and fence the embeddings nobody thinks about.

Listings are public by design; drafts and seller details are not. Shape RLS for directory and marketplace tables on Supabase so publicity is a decision, not an accident.

A CRM contact table reachable through the anon key is a breach-shaped problem. Confirm the exposure, scope contacts to workspace members, and put watching in place.

Device telemetry arrives from firmware you do not control. Constrain the write path with WITH CHECK so a spoofed device id cannot append into another fleet’s history.

Inheriting a Supabase project built by someone else? Map the reachable surface, reconstruct the access model and price the findings before changing anything.

What SOC 2 examiners typically ask about database access, and what row-level security evidence looks like. Informational only — not legal or compliance advice.

What a defensible access-control posture looks like on a Supabase backend when personal data is in scope. Informational only — this page is not legal advice.

Postgres keeps no native history of policy changes. How to reconstruct one with migrations and logs, and what RowShield records between scans automatically.

The dashboard Security Advisor is a good point-in-time check. What continuous monitoring adds is the interval between looks: drift, regressions and behaviour.

Static linters read policy definitions before they ship; live probes request the running API after. Different instruments, different failure classes, complementary.

Test harnesses assert policy behaviour inside CI against a database you point them at. Managed monitoring watches production continuously. They complement.

An ordered checklist for auditing a Supabase project by hand with psql and curl, an honest account of what a snapshot cannot tell you, and how to automate it.

Four free routes to a Supabase security audit — the built-in advisor, hand-run SQL, self-made probes and RowShield's free tier — and what each yields.

Paste your project URL and get a free RLS audit of your live surface plus catalog checks. GET requests only, nothing stored, no account required.

Your deployed app hands every visitor an anon key, sometimes something stronger. Probe your live URLs from outside and read exactly what they expose.

Security reduces to three verifiable things: RLS on every reachable table, policies granting only what you intend, bypass keys off the client.

One query against pg_class lists every public-schema table with its RLS flag. Here is the query, the FORCE flag people miss, and the fix for a false.

pg_policies renders every policy in your project with its command, roles and conditions. Here is the query, each column explained, and what to hunt for.

Admin sessions bypass the machinery under test. Ask PostgREST as the anon key instead: here is the request, and how to read rows, empty arrays, errors.

A tautological policy such as USING (true) admits every row to every role it names while RLS reports enabled. Definition, detection query, honest fix.

Turning RLS on denies every client row until a policy grants it. Ship enable and policies in one migration and the break window is a single deploy.

Every check that matters for a Supabase backend across tables, keys, storage, performance and process, each with the query that verifies it.

RLS, policies, USING and WITH CHECK, tautology, FORCE, BYPASSRLS, service_role, anon, PostgREST, drift, transitions and remediation SQL defined plainly.

Fixed on Friday, flagged again Monday: findings return because the fix lived in the database while the cause lives in the process. Break both halves.

Fifteen client projects on one dashboard, alerts routed per destination with thresholds you choose, evidence you can hand each client. Built for rosters.

Wire rowshield scan into the same flow as supabase db push: one command, three exit codes, remediation SQL printed on failure. Shipped interface, no roadmap.

What a planned GitHub Actions integration would check and fail on, plus the pattern you can adopt today with plain steps and scheduled scans. No dates promised.

Preview deploys get their own environment variables and their own surprises. What a planned preview-audit integration would do, and how to check previews today.

What a RowShield Slack alert contains, how per-destination severity thresholds work, and why alerts fire on transitions only. Slack delivery starts on Indie.

How RowShield renders findings as Discord embeds, how per-destination thresholds route them, and why repeats stay quiet. Discord delivery starts on the Team plan.

Script scans today through the CLI and its exit codes; a planned API would expose the same semantics over HTTP. Design goals stated, dates promised none.

Where RLS policies should live, which Terraform habits prevent drift, and how scheduled scans catch the divergence that code review alone cannot.

Most RLS regressions enter through ordinary migrations. A pairing rule, a short reviewer checklist, and scheduled scans as the safety net underneath.

Find tables with Row Level Security disabled, policies that evaluate to true, and writes with no WITH CHECK — then keep them from coming back.

The service_role key bypasses RLS entirely. Find it in your deployed JavaScript before someone else does — free, no signup, no code access needed.

Unindexed RLS predicates and bare auth.uid() calls turn every query into a sequential scan. Find both, with the SQL to fix them.

Free, no-signup check for tables readable with your public anon key, RLS switched off, and service_role keys in the bundle.

Find every table Bolt created without Row Level Security, and get the enable-plus-policy SQL generated from your real columns.

Cursor writes plausible RLS. Check for policies that evaluate to true, writes without WITH CHECK, and predicates with no index.

Know when a table appears without policies, a policy is rewritten, RLS is switched off, or a bucket flips to public — and when a fix regresses.

A SECURITY DEFINER view runs as its owner and ignores the caller RLS policies. Here is how to find them yourself, with the catalog queries.

The advisor is a point-in-time check you have to open. Continuous scanning, drift diffing, alerts and CI exit codes are what it is missing.

Scheduled catalog audits, drift diffing, Slack and webhook alerts on transitions, and CI exit codes — on a paid plan above the free tier.