Guide

Supabase RLS checklist before you launch

AI coding tools often create tables and forget Row Level Security. The anon key is public by design. If RLS is off, anyone with that key can read the table. Work through this list on the app you own.

  1. Turn RLS on for every table in the exposed schema. In the Supabase dashboard, a table without RLS shows a warning. A table with RLS and no policies returns nothing, which is safer than the opposite.
  2. Never ship the service_role key. It bypasses RLS. It belongs only in server-side code or edge functions. If it is in the browser bundle, rotate it now and remove it from the client.
  3. Write policies per action. SELECT, INSERT, UPDATE and DELETE each need a rule. A common pattern is auth.uid() = user_id on rows the signed-in user owns.
  4. Test as the anon key, not as the dashboard. The table editor uses a privileged role, so it hides leaks. Use the free Supabase check: paste your project URL and anon key. It runs in your browser and lists tables the anon key can read.
  5. Test as two real users. Create user A and user B. Sign in as B and try to read, update and delete A's rows by id. "RLS enabled" is not enough if a policy says auth.role() = 'authenticated' with no owner check: every logged-in user can then read every row.
  6. Check views, storage and functions. Storage buckets and database functions marked security definer can bypass table policies. Review each one.
  7. Re-test after the next AI edit. One prompt can add a table or drop a policy. Re-run the check before you share the link.

What "good" looks like

Anon key

Can read only data you intend to be public. Cannot read profiles, orders, messages or files.

User B

Can read and change only B's rows. Requests for A's ids return empty or an error, not A's data.

service_role

Absent from the website's JavaScript. Present only on the server.

Want this run for you?

NordKiln Scan (early access) logs in as two test users and reports which tables leak, with a fix prompt for Cursor, Claude Code, Bolt, Replit or v0.

One email when the scanner opens, then occasional notes. Unsubscribe anytime. We use FormSubmit; your address goes to dan.nordkiln@gmail.com and is not sold.