criticalaccess-controlconnected project

Row Level Security disabled

RLS_DISABLED

Any table reachable through PostgREST with RLS disabled is world-readable to anyone holding the anon key — which ships in your client bundle and is public by design. Every row is exposed.

What the finding looks like

criticalRow Level Security is disabled on public.invoices

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by VibeGuard. Review before running in production.
ALTER TABLE public.invoices ENABLE ROW LEVEL SECURITY;
ALTER TABLE public.invoices FORCE ROW LEVEL SECURITY;

CREATE POLICY invoices_select_own
  ON public.invoices
  FOR SELECT
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_insert_own
  ON public.invoices
  FOR INSERT
  TO authenticated
  WITH CHECK (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_update_own
  ON public.invoices
  FOR UPDATE
  TO authenticated
  USING (user_id = (SELECT auth.uid()))
  WITH CHECK (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_delete_own
  ON public.invoices
  FOR DELETE
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

Related guides

What people search for

supabase rls disabledsupabase rls disabled in public schema warningsupabase public table no rlshow to check if supabase rls is enabled on all tables

Check your own project

This rule needs a connected project. Start with the free probe to see what is exposed publicly.

Run the free audit