Lab results
Multiple permissive policies on a table
0006_multiple_permissive_policiesWARN
Permissive policies combine with OR: if any one of them says yes, access is granted. With several on one table, a loose leftover policy can quietly undo a strict new one.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select tablename, cmd, array_agg(policyname) as policies
from pg_policies
where schemaname = 'public'
and permissive = 'PERMISSIVE'
group by tablename, cmd, roles
having count(*) > 1;
- Line 6: Each row is one table and action with several policies that combine. Read them together: the loosest one wins.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
Each round of AI fixes adds a new policy instead of changing the old one, so tables collect overlapping rules.
The real fix
Merge them into one policy per table, action and role, so you can read in one place who gets in. Delete the leftovers.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Before deleting a policy, check whether the app relied on it. Test the affected pages with two accounts afterwards.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every table in supabase/migrations with more than one permissive row level security policy for the same action and role. For each, explain in plain English who the combined policies let in, and point out any that is looser than the rest. In a new migration, merge them into one policy per table, action and role. Do not use using (true). List what you changed.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.