Lab results
User data exposed through a view
0002_auth_users_exposedERROR
A view in the public schema reads from auth.users, Supabase’s table of accounts with email addresses and sign-in details, and makes it reachable through your API. Depending on the view, anyone can list your users’ email addresses.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select view_name
from information_schema.view_table_usage
where view_schema = 'public'
and table_schema = 'auth'
and table_name = 'users';
- Line 5: Each view listed exposes data from your user accounts. Fixed means this returns no rows.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
To show a name or email next to a post, an AI joins auth.users into a view. It works, and it publishes your user list.
The real fix
Keep the fields you want to show (name, avatar) in a profiles table in the public schema, filled by a trigger when someone signs up, with its own RLS policies. Point the page at profiles and drop the view on auth.users.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: A trigger on auth.users that fails blocks sign-ups. After the change, sign up a brand-new test account to make sure it still works.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every view in supabase/migrations that reads from auth.users. Replace it with a profiles table in the public schema that holds only the fields my app shows (no email unless the page needs it), filled by a trigger on new sign-ups, with row level security so each user can only update their own profile. Update the frontend to read from profiles. Do not change auth settings. List every file you changed and how I can test that sign-up still works.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.