2026-10-31 · Daily security tips

Is RLS on, but one policy lets everyone read?

Supabase apps ship the anon key in the browser, so Row Level Security is what keeps each user's rows private. AI builders often enable RLS and then add a quick policy like using (true) to make an error go away. That policy lets every visitor read every row.

Check: in the Supabase dashboard open Authentication > Policies, or run the Security Advisor. Look for any SELECT, UPDATE or DELETE policy whose condition is just true, and for tables marked unrestricted.

Fix: replace it with an owner rule such as auth.uid() = user_id, and only keep using (true) on data you genuinely mean to be public, like published blog posts.

Then test it: sign in as a second user and try to load the first user's data.