← All posts

Is your Supabase table open to everyone?

Your Supabase anon key ships in your frontend, and that's fine. It's only safe if Row Level Security guards every table. If RLS is off, or a policy says using (true), anyone holding that key can read every row. I sniff this one out a lot in AI-built apps.

Check (your own app only)

  1. In Supabase, open Advisors → Security Advisor and look for "RLS Disabled in Public".
  2. In the SQL editor, run select tablename, policyname, qual from pg_policies;. A qual of true means open to everyone.

Fix it

  1. Run alter table your_table enable row level security;
  2. Replace open policies with owner-only ones, like using ((select auth.uid()) = user_id).
  3. Sign in as a second test user and confirm you can't see the first user's rows.

Want a second nose? Run a free scan at sniffpup.com.