Lab results
Security policy allows unrestricted access
0024_permissive_rls_policyWARN
RLS is on, but a policy on this table says yes to everyone it applies to, typically using (true) or with check (true). For that action, the table behaves as if RLS were off. If the policy is for authenticated users, anyone who can sign up gets in; if it is for anon or public, anyone at all.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select tablename, policyname, cmd, roles
from pg_policies
where schemaname = 'public'
and (qual = 'true' or with_check = 'true');
- Line 4: Each row is a policy that lets everyone it applies to through. Fine for truly public data, a leak for anything that belongs to one user.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
It is the standard way an AI makes an error go away: after RLS was turned on, the app could not read its data, so the AI added a policy that allows everything. Supabase rates it only WARN because sometimes open is intended, like a public list of blog posts.
The real fix
Replace each one with a real condition, usually “owner column = auth.uid()”. It goes in using for select, update and delete; in with check for insert and update. Keep using (true) only for data meant to be public, and only for select.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Test with two accounts, not one. Sign in as user A and create something, then sign in as user B and try to load it. With one account everything looks fine, because you only ever see your own data.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every row level security policy in supabase/migrations that uses using (true) or with check (true). For each one, tell me in plain English who it lets in. Unless the data is meant to be public, replace it in a new migration with a condition that limits rows to their owner (owner column = auth.uid()): using for select, update and delete, with check for insert and update. Do not change any application code. List the policies you changed and the ones you left open on purpose, with the reason.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.