2026-11-07 · Daily security tips

Did you add a new table and forget to turn RLS on?

You enable Row Level Security on users and profiles early on. Then you add messages, orders or uploads. In Supabase, a new table starts with RLS off, so the public anon key can read every row until you turn it on.

Check: open Table Editor and look for tables without the RLS badge, or Authentication > Policies and Security Advisor for tables marked unrestricted / RLS disabled.

Fix: run alter table your_table enable row level security; then add owner policies (for example auth.uid() = user_id). Sign in as a second user and confirm you cannot see the first user's rows.