Lab results
Signed-out users can run a security definer function
0028_anon_security_definer_function_executableWARN
A database function runs with its owner’s rights (security definer), which skips RLS, and anyone can call it through your API without signing in. Whatever the function reads or changes, any visitor can.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select p.proname as function_name
from pg_proc p
join pg_namespace n on n.oid = p.pronamespace
where n.nspname = 'public'
and p.prosecdef
and has_function_privilege('anon', p.oid, 'execute');
- Line 6: Each function listed bypasses RLS and can be called without signing in.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
AI tools write security definer functions to get around an RLS error, and new functions can be called by everyone unless that right is taken away.
The real fix
Take the right away (revoke execute on function … from anon, public), or switch the function to security invoker if it does not need its owner’s rights. If it really must be public, it has to check its inputs and who is calling.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Signed-in users get the same right by default (Supabase’s lint 0029). Revoking it from anon alone still lets anyone who can sign up call the function.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every function in the public schema of my Supabase project that is security definer. For each, explain in plain English what it reads or changes and who can call it. In a new migration, revoke execute from anon and public, and from authenticated where the function is only for my server. Switch functions to security invoker where they do not need owner rights. List every function you changed and how my app calls it.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.