Lab results
Anonymous sign-ins enabled
0012_auth_allow_anonymous_sign_insINFO
Anonymous sign-ins let visitors use your app without an account. Supabase gives those visitors the same authenticated role as real users, so every policy written “for authenticated users” lets anonymous visitors in too.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select tablename, policyname, cmd
from pg_policies
where schemaname = 'public'
and 'authenticated' = any(roles)
and coalesce(qual, '') not ilike '%is_anonymous%'
and coalesce(with_check, '') not ilike '%is_anonymous%';
- Line 4: Each policy listed treats anonymous visitors like real users. That is only right if guests should have the same access.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
Turned on to try a guest mode or a demo, then forgotten. Meanwhile policies “for any logged-in user” were written on the assumption that logged in means having a real account.
The real fix
If you do not need guest mode, switch anonymous sign-ins off in the Authentication settings. If you do, add a check on the is_anonymous claim to every policy that should be for real accounts only.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Turning it off does not remove guest sessions that already exist. Review the policies anyway.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Check whether my app uses Supabase anonymous sign-ins. List every row level security policy that applies to the authenticated role and tell me which ones anonymous users can pass. For actions that should need a real account (posting, paying, changing data), add a check on the is_anonymous claim in a new migration. Do not change auth settings without asking me.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.