Supabase and RLS: the 2-minute check

· Published · 1 min read

AI regularly forgets a Supabase setting that decides whether anyone can read your database.

It is called RLS, and it is not enabled by default on tables created via SQL… And guess who uses SQL to create them? AI! Most of the time it sets everything up properly… but it is not infallible.

Last year, 170+ Lovable apps had their database siphoned off this way. Emails, payments, API keys.

The 2-minute check if you use Supabase

  1. Supabase dashboard ⇒ Database ⇒ Policies.
  2. Look for tables marked “RLS disabled” or with no policy at all.

⇒ A table with no policy = a public table.

RLS sits near the top of what I look at on a Supabase project.

You’re welcome :)

Sources