Lab results
Unsecured function search path
0011_function_search_path_mutableWARN
A database function does not pin which schemas it looks in (its search path). When it names a table or function without a schema in front, Postgres looks it up in whatever schemas the caller’s session has set, so someone able to create their own objects could make it find theirs instead. On its own it is rarely an open door, but it matters for functions that run with their owner’s rights.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select p.proname as function_name
from pg_proc p
join pg_namespace n on n.oid = p.pronamespace
where n.nspname = 'public'
and not exists (
select 1 from unnest(coalesce(p.proconfig, '{}')) c
where c like 'search_path=%'
);
- Line 5: Each function listed looks up names wherever the caller points it. Fixed means this returns no rows.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
Every function an AI writes for you, like the trigger that creates a profile on sign-up or a helper used in your policies, gets this warning unless it adds a fixed search path. That is why it often shows up a dozen times.
The real fix
Add set search_path = '' to each function and write every name inside it with its schema (public.profiles, not profiles). Do both in the same change: pinning the path without qualifying the names breaks the function.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: A trigger function that breaks this way can block sign-ups, because profile triggers run on every new account. After the change, sign up a new test account.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every function in the public schema of my Supabase project (in supabase/migrations) that does not set a fixed search_path. In a new migration, recreate each one with set search_path = '' and write every table, view and function it uses with its schema (for example public.profiles and auth.uid()). Do not change what the functions do. List every function you changed and tell me which ones run on sign-up, so I can test signing up afterwards.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.