Symptoms
- Supabase shows a warning that RLS is disabled on a table
- Logged-in users can see data that belongs to other users
- You never set up any database rules or policies
- Private data loads even when nobody is logged in
Why it happens
Supabase gives your app a public key, often called the anon key. That key sits in your website code, where anyone can see it. This is normal, but it is only safe when Row Level Security is turned on.
Row Level Security, or RLS, is a set of rules inside the database. The rules say who can read, add, change or delete each row. Without them, the public key opens the whole table.
AI tools sometimes create tables without these rules, because the demo works faster that way. The app looks fine. The database is open.
Try this first
-
Find tables without RLS
In Supabase, open the Table Editor. Tables without RLS show a warning. The Security Advisor in the dashboard also lists them.
-
Turn RLS on for each table
Enable RLS on every table that holds user data. After this, the app will stop showing that data until you add rules. That is expected.
alter table public.notes enable row level security; -
Add rules so users only see their own rows
The most common rule is simple: each user can read and change only their own rows. For that, the table needs a column with the user id, often called user_id. Replace notes with your table name.
create policy "Users can read their own notes" on public.notes for select using ( auth.uid() = user_id ); create policy "Users can add their own notes" on public.notes for insert with check ( auth.uid() = user_id ); create policy "Users can update their own notes" on public.notes for update using ( auth.uid() = user_id ); -
Test with two accounts
Log in as one user and create some data. Then open a private window, log in as a second user and check that you cannot see the first user’s data.
-
Think about what was exposed
If a table held personal data while RLS was off, consider who could have seen it. Change any secrets that were stored in the database, and check your local rules about telling users.
When to stop and call a person
Get help if your tables have no user id column, if data is shared between teams or roles, or if you are not sure what was exposed. Wrong rules can lock real users out or leave gaps, so this is a good place for a second pair of eyes.
Questions people ask
Is the anon key a secret?
No. It is meant to be public. Your protection comes from the RLS rules, not from hiding that key.
What about the service role key?
That one is secret. It skips every RLS rule. It must never be in your website code. If it is, create a new one in Supabase right away and remove the old one from the code.