mediumperformanceconnected project

auth.uid() not wrapped in a subquery

RLS_UNWRAPPED_AUTH_CALL

A bare auth.uid() inside a policy is re-evaluated once per candidate row. Wrapping it as (SELECT auth.uid()) lets the planner hoist it into an InitPlan evaluated once per statement — routinely a 10-100x speedup on large tables, with identical semantics.

What the finding looks like

mediumPolicy "invoices_access" on public.invoices calls auth.uid() per row

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by VibeGuard. Review before running in production.
-- Wrapping the call turns a per-row evaluation into a single InitPlan.
-- The semantics are identical.

ALTER POLICY invoices_access
  ON public.invoices
  USING ((( SELECT auth.uid() ) = user_id));

Related guides

What people search for

auth.uid() initplan optimizationsupabase rls select auth.uid() wrapwhy is my supabase bill spiking after adding rls policies

Check your own project

This rule needs a connected project. Start with the free probe to see what is exposed publicly.

Run the free audit