4 Supabase policy red flags, explained in plain English

Row Level Security decides who can read and change each row through your Supabase API. Watch for these:

1. RLS never enabled on a public table.
2. Always-true policies like using (true) or 1 = 1.
3. Signed-in only checks, which let any user see every user's rows.
4. Trusting user_metadata, which users can edit themselves.

Check yours

Run select * from pg_policies; in the SQL editor and paste the result into the free RLS policy explainer. For red flag 1, add your schema SQL, since pg_policies skips tables without policies. The explainer runs in your browser and nothing you paste is sent to SniffPup. Then run a free scan at sniffpup.com to see what strangers see.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.