Lab results
No access rules defined
0008_rls_enabled_no_policyINFO
RLS is on and no policy exists, so the API refuses every read and write on this table. That is safe: nothing leaks. But if your app uses this table from the browser, that part of the app is broken.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select t.tablename
from pg_tables t
left join pg_policies p
on p.schemaname = t.schemaname and p.tablename = t.tablename
where t.schemaname = 'public'
and t.rowsecurity = true
and p.policyname is null;
- Line 7: Each table listed is locked for the API. Fine if only your server uses it; broken if your app reads it from the browser.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
Usually the first half of a fix. The risk is the second half: asked to make the app work again, an AI often adds a policy that allows everything.
The real fix
If your app needs the table, add policies that let each user reach only their own rows. If only your server uses it (with the service role key, which bypasses RLS), leave it locked.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Do not let the AI fix a broken page with using (true). That turns a locked table into an open one.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
These tables have row level security on but no policies: [paste the list]. For each one, tell me whether my app reads or writes it from the browser. For the ones it does, add policies in a new migration in supabase/migrations so users can only reach their own rows (owner column = auth.uid(); using for select, update and delete, with check for insert and update). Never use using (true). Leave tables that only the server uses locked.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.