Lab results
Supabase security warnings, explained
Your Supabase dashboard has a Security Advisor (under Advisors) that checks your database for common gaps. If you built your app with Lovable, Bolt, Cursor or Claude Code, it often shows a few. Here is what each one means for you, a check you can run yourself and a prompt that asks your AI for the real fix.
ERROR usually means your data is reachable by people who should not see it. WARN means it might be, depending on your app. INFO is worth a look. One rule for all of them: AI tools are good at making a warning disappear, which is not the same as fixing it.
Codes and titles are Supabase’s, the explanations are mine. Last checked . Using Lovable? See what its security scan checks.
The security warnings
- ERROR
Table publicly accessible
0013_rls_disabled_in_publicRow level security is off on a table, so anyone with your public key can read, change or delete every row. What it means and how to fix it for real.
- ERROR
Security policy relies on user-editable data
0015_rls_references_user_metadataA policy trusts user_metadata, which every user can change themselves. Anyone can make themselves admin. How to check it and move roles somewhere safe.
- ERROR
View bypasses row-level security
0010_security_definer_viewA view runs with its creator’s rights and ignores RLS, so it can show every user’s data. How to find these views and make them respect RLS.
- ERROR
User data exposed through a view
0002_auth_users_exposedA public view reads auth.users, so your users’ emails can be listed through the API. How to check and replace it with a profiles table.
- ERROR
Sensitive data publicly accessible
0023_sensitive_columns_exposedAn open table holds columns that look like passwords, tokens or ID numbers. The worst kind of RLS gap: what to fix and what to rotate.
- WARN
Security policy allows unrestricted access
0024_permissive_rls_policyA policy like using (true) lets everyone through, so RLS is on but does nothing. How to tell a harmless one from a leak, and how to fix it.
- WARN
Public bucket allows listing
0025_public_bucket_allows_listingA broad policy on a public storage bucket lets anyone list and download every file. What to check and when the bucket should be private.
- WARN
Signed-out users can run a security definer function
0028_anon_security_definer_function_executableA function that bypasses RLS can be called by anyone, signed in or not. How to find these functions and lock them down.
- WARN
Multiple permissive policies on a table
0006_multiple_permissive_policiesSeveral permissive policies combine with OR, so one loose leftover can undo a strict new rule. How to find and merge them.
- WARN
Unsecured function search path
0011_function_search_path_mutableAlmost every AI-built Supabase app shows this one, often many times. What a search path is, how serious it is for you and the five-minute fix.
- WARN
Extension installed in public schema
0014_extension_in_publicAn extension sits in your public schema, so its functions show up in your API. Usually harmless, quickly moved. How to check and what to test.
- WARN
Any signed-in user can run a security definer function
0029_authenticated_security_definer_function_executableA function that bypasses RLS can be called by every signed-in user. If anyone can sign up, that means anyone. How to find and lock these functions.
- INFO
Security policy not enforced
0007_policy_exists_rls_disabledPolicies exist on a table but RLS is off, so they do nothing and the table is open. Why it happens with AI tools and how to switch them on safely.
- INFO
No access rules defined
0008_rls_enabled_no_policyRLS is on but no policy exists, so your app can’t read or write the table. Safe, but the usual next “fix” is a dangerous one.
- INFO
Anonymous sign-ins enabled
0012_auth_allow_anonymous_sign_insAnonymous users count as authenticated, so every “logged-in users only” policy lets them in too. How to check your policies and when to turn it off.
Warning gone? Get it checked.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.