Lab results
Security policy relies on user-editable data
0015_rls_references_user_metadataERROR
A policy decides who gets in based on user_metadata, for example role: "admin" stored there. Any signed-in user can change their own user_metadata from the browser, so anyone can give themselves that role and pass the check.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select tablename, policyname
from pg_policies
where schemaname = 'public'
and (qual ilike '%user_metadata%'
or with_check ilike '%user_metadata%');
- Line 4: Each policy listed trusts data the user controls. Fixed means this returns no rows.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
Storing the role in user metadata is the quickest way to get an admin area working, so AI tools reach for it.
The real fix
Keep roles where users cannot write: in app_metadata, which only your server (with the service role key) can set, or in a roles table that only your server writes to. Then point the policies there.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: Look beyond the policies: edge functions and the frontend often read the same user_metadata to show the admin area. All of them have to move.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every place in my code and in supabase/migrations that reads a role or permission from user_metadata (raw_user_meta_data), including row level security policies, edge functions and frontend checks. Move the role to app_metadata, set only from the server, and update every place that reads it. Explain in plain English why user_metadata is unsafe for this. List every file and policy you changed.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.