Lab results

Extension installed in public schema

0014_extension_in_publicWARN

A Postgres extension (for example vector, pg_trgm or ltree) is installed in your public schema. Everything in public is reachable through your Supabase API by default, so the extension’s functions and tables appear there next to your own. Usually harmless; sometimes it exposes more than you meant.

Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked October 2026.

X-rayCheck it yourself: SQL editor1 fracture

1select e.extname
2from pg_extension e
3join pg_namespace n on n.oid = e.extnamespace
4where n.nspname = 'public';1

Line 4: Each extension listed lives in public. Fixed means this returns no rows.

Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.

Why AI-built apps get it

AI tools install extensions with a plain create extension, which puts them in public.

The real fix

Move each one to its own schema: create schema if not exists extensions, then alter extension … set schema extensions.

Treatment

Fix it with your AI, then make sure it holds

Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.

Watch out: Code that calls the extension’s functions without a schema may stop finding them. After the move, test the features that use it, like search or embeddings.

Your AI says it’s fixed. Is it?

The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.

Book a Safety Scan See a sample report

Fix promptSlop Medic

List every Postgres extension installed in the public schema of my Supabase project and what my app uses it for. In a new migration, move each one to an extensions schema (create it if it does not exist) with alter extension … set schema extensions. Then find every place in my code and migrations that calls the extension’s functions or types without a schema and tell me whether it still works. Do not drop any extension.

Signed

Get your app triaged.

From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.

Book a check-up Read a sample report

Visiting hoursBook any time. I reply within one business day.