Comparisons / Approaches
Doing nothing versus monitoring Supabase security, calmly costed
The short version
- Doing nothing is the default configuration of attention: no scanner, no scheduled review, posture checked only when memory prompts. It trades a small certain saving for a small uncertain risk — reasonable for throwaway prototypes, costly accident for anything holding real user data.
- Choose Doing nothing when — the database is disposable, synthetic or nearly empty, and attention spent on posture is attention taken from finding users.
- Choose RowShield when — the project holds data whose confidentiality matters, and you want posture checked regularly without hiring anyone or reading dashboards nightly.
RowShield rules relevant here
Head to head: Doing nothing vs RowShield
| Capability | Doing nothing | RowShield | Edge |
|---|---|---|---|
| Standing assumption | Assumes yesterday held, and projects that belief forward. | Assumes posture moves, and verifies it on schedule. | Parity |
| Default exposure in Postgres | Unmeasured; without row-level security enabled, broad anon access is the default, not the exception. | Measured directly: tables reachable by anon and authenticated roles enumerated each scan. | RowShield |
| Exposure window length | Weeks to months in practice, bounded only by when someone happens to look. | Bound by the scan interval — typically hours — with history showing exactly when it opened. | RowShield |
| Cost while nothing is wrong | Zero, which is the honest appeal of the option and the reason it persists. | A modest subscription and periodic reports nobody needs to read. | Doing nothing |
| Cost when something is wrong | Discovery on someone else’s timeline, followed by forensics without a baseline. | A finding with remediation SQL while the window is still small. | RowShield |
| Evidence of diligence | Nothing recorded, which reads as neglect whether or not neglect occurred. | Scan history demonstrates sustained care to reviewers, buyers and insurers. | RowShield |
| Attention required | None, until an incident consumes far more than monitoring ever asked. | Minutes per week to read what changed. | RowShield |
Column claims about Doing nothing are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What doing nothing does
Doing nothing deserves fair treatment, because most teams practise it most of the time and catastrophe remains rare. Fear-selling aside, it trades a small certain saving for a small uncertain risk. No scanner runs, no review recurs; posture is examined when memory prompts, which is to say rarely and late.
The trade sharpens with stakes. Postgres permits broad access unless restricted; in Supabase the anon and authenticated roles reach tables through the API, and without row-level security the reach is wide. Doing nothing therefore has content, not merely absence: it is a standing decision to let defaults govern.
Where the scopes differ
The measurable difference is the window. Every misconfiguration has an opening moment and a closing moment, and harm scales with the distance between them. Under do-nothing, closing waits for accidental discovery: a curious user, a screenshot in the wild, a routine review months later. Windows of weeks and months are ordinary, and reconstruction is guesswork because nothing recorded the opening.
Monitoring compresses the window mechanically. A widening introduced Tuesday evening is described Tuesday night, with the offending statement identified and corrective SQL attached. Caught earlier, the same error is cheaper in every dimension: fewer rows reachable, fewer copies cached, less trust spent. Behavioural checks shorten it further, confirming what the API actually returns rather than what configuration implies.
Why Supabase teams choose RowShield over doing nothing
Because the price of attention fell below the price of hope. Connecting takes minutes, scans run on schedule, and findings arrive as short explanations mapped to the rules governing Supabase exposure — RLS_DISABLED and ANON_TABLE_READABLE chief among them. Nobody studies dashboards; the report states what became reachable, when, and how to close it.
There is also compounding: each scan extends a history, and history turns incidents from archaeology into lookup. Here is the date the policy widened, here is its prior form, here is the diff restoring it. Doing nothing leaves that narrative unwritten.
Where doing nothing is the right choice
Prototypes with synthetic data, internal toys, databases scheduled for deletion next sprint: monitoring them is theatre, and declining is rational. Attention is finite, and pre-product teams may genuinely price an evening of feature work above an evening of assurance.
The honest test is reversibility. Once the data is real, the users external, or the roadmap pointed at customers, the earlier decision deserves revisit — posture debt compounds quietly, and interest falls due at the least convenient funding round or headline.
Using both
These options do not combine, but they sequence. Teams commonly declare a deliberate do-nothing period until first real users, then switch monitoring on as launch hygiene. Framed that way, doing nothing was never negligence; it was a timed decision awaiting its trigger.
The failure mode worth avoiding is drift by inertia, where the prototype exemption persists accidentally into production. A calendar reminder costs nothing and prevents it.
Frequently asked
- Is RowShield affiliated with Supabase?
- No. Veristria is independent; RowShield is not built by, endorsed by or affiliated with Supabase. References to Supabase documentation are purely informational.
- Are we negligent if we monitor nothing right now?
- Not necessarily. Negligence concerns stakes ignored, not stakes absent. A prototype without users can defer the work honestly; the obligation begins when real data meets real reachability.
- How bad can a default posture actually be?
- Without row-level security, API-exposed tables are broadly readable by the anon role — by design rather than attack. Whether that matters depends entirely on what the rows contain.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit