Lab results
Table publicly accessible
0013_rls_disabled_in_publicERROR
Row level security (RLS) is switched off on a table in the public schema. Supabase serves every public table through its API, and the key your app uses for that (the anon or publishable key) ships in your website’s code by design. So anyone who opens your site can read, change or delete every row of this table, without logging in.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select tablename
from pg_tables
where schemaname = 'public'
and rowsecurity = false;
- Line 4: Every table this lists is open to anyone with your public key. Fixed means this returns no rows.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
AI tools create tables quickly and often skip turning RLS on, or add a table later in a migration without it. The app works perfectly in the demo, because nothing is blocked. In 2026 UpGuard found 16,326 Supabase databases with tables anyone could read.
The real fix
Turn RLS on for each table and, in the same step, add policies that say who may read and change which rows, usually “the row’s owner column equals auth.uid()”. RLS without policies blocks your own app, so do both together.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: The fix that isn’t: the AI turns RLS on and the app breaks. Then the AI adds a policy with using (true) to make it work again. The warning disappears and the table is exactly as open as before. Supabase then shows “Security policy allows unrestricted access” instead.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
In supabase/migrations, add a new migration that enables row level security on every table in the public schema that does not have it yet. For each of those tables, add policies so users can only select, update and delete their own rows (owner column = auth.uid()), and use with check so they can only insert and update rows they own. Never use using (true) or with check (true). Do not change any application code. List every table and policy you changed, and tell me which tables you were unsure about.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.