Lab results
Any signed-in user can run a security definer function
0029_authenticated_security_definer_function_executableWARN
A database function runs with its owner’s rights (security definer), which skips RLS, and every signed-in user can call it through your API. If anyone can sign up for your app, that means anyone at all can run it, with more rights than they should have.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select p.proname as function_name
from pg_proc p
join pg_namespace n on n.oid = p.pronamespace
where n.nspname = 'public'
and p.prosecdef
and has_function_privilege('authenticated', p.oid, 'execute');
- Line 6: Each function listed bypasses RLS and every signed-in user can call it. Fine only if it checks who is calling.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
AI tools write security definer functions to get around an RLS error, and new functions can be called by every role unless that right is taken away.
The real fix
If only your server needs the function, take the right away (revoke execute on function … from authenticated, anon, public). If users need it, make sure it checks who is calling (auth.uid()) and only touches their own data, or switch it to security invoker.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Signed-out users usually have the same right (Supabase’s lint 0028). Fix both, or the function is still open to everyone.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every security definer function in the public schema of my Supabase project. For each, explain in plain English what it does and whether a signed-in user could use it to read or change someone else’s data. In a new migration, revoke execute from anon and public on all of them, revoke it from authenticated where only my server needs the function, and add an auth.uid() check to the ones users really call. List every change.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.