Lab results
Security policy not enforced
0007_policy_exists_rls_disabledINFO
Someone wrote policies for this table, but RLS is switched off, so the policies are never checked. The table is as open as if no policies existed: anyone with your public key can read and change it.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select distinct p.tablename
from pg_policies p
join pg_tables t
on t.schemaname = p.schemaname and t.tablename = p.tablename
where p.schemaname = 'public'
and t.rowsecurity = false;
- Line 6: Each table listed has policies that are switched off. Fixed means this returns no rows.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
The AI wrote the policies in one step and never enabled RLS, or RLS was switched off while debugging and never switched back on.
The real fix
Enable RLS on each table (alter table … enable row level security). Then read the existing policies: they start working exactly as written.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Turning RLS on activates the old policies as they are. If one of them was a quick using (true), the table is still open, only with a quieter warning.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
In supabase/migrations, add a new migration that enables row level security on every public table that has policies but RLS switched off. Before you do, show me each existing policy on those tables and explain in plain English who it lets in. Flag any policy that uses using (true) or with check (true). Do not change any application code.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.