A Supabase RLS checklist
Row level security is the single most common hole in AI generated apps. These are the checks we run on every table before we let a project launch.
- 19 Aug 2026
Supabase makes it trivial to stand up a database and talk to it straight from the browser. That is the appeal, and it is also the risk. The client holds a key, so the database itself has to be the thing that says no.
The checks are mechanical. Is row level security enabled on every table in the public schema, including the ones added last week. Does every table have an explicit policy rather than inheriting a permissive default. Are policies written against the authenticated user rather than a column the client can set. Are service role keys confined to server side code. Can a user read somebody else’s row by changing an id in a request.
We run this list before anything else in a rescue, because a single missing policy usually means every record in that table has been readable by anyone who thought to look. It is the cheapest audit in software and the most expensive one to skip.