If you built your app with an AI builder, there's a good chance it uses Supabase for its database. Supabase is excellent, but it has one setting that decides whether your users' data is private or public to the whole internet: row-level security (RLS).

The 60-second explanation

Your app talks to Supabase using a public key. It's called public because it ships to every visitor's browser, so treat it as known to everyone.

That's safe only if the database itself enforces who can see what. That's RLS: rules attached to each table, such as "a user can only read rows where user_id matches their own ID".

• RLS on, with good policies: visitors can only touch their own data.
• RLS off: anyone with the public key, meaning anyone, can read, change or delete every row in that table.

How to tell if you're exposed

1. Open your Supabase dashboard, then Table Editor.
2. Each table shows whether RLS is enabled. Look for any table marked as unrestricted.
3. For tables with RLS on, open Authentication → Policies and check there's at least one policy. RLS on with zero policies blocks everyone, which is safe but may break your app.

Supabase's own Security Advisor (under Advisors) also flags tables without RLS.

The fix

Paste this into your AI builder:

For every table in my Supabase database:
1. Enable row-level security.
2. Add policies so signed-in users can only select, insert, update and delete
   their own rows (matching auth.uid() to the table's user_id column).
3. For tables that should be public (like a product catalog), add a read-only
   policy for everyone and no write access.
Show me the SQL and explain each policy in plain English before applying it.

Three mistakes to avoid

Using the service-role key in the browser. The service-role key ignores RLS entirely. It belongs only in server code: API routes, edge functions, background jobs. Never in a component that runs in the browser, and never in a NEXT_PUBLIC_ variable.

"Fixing" errors by turning RLS off. When a policy blocks something, AI builders sometimes suggest disabling RLS to make the error go away. Don't. Ask for a policy that allows exactly the access you need.

Forgetting new tables. RLS is per table. Every table your builder adds later needs it too. Make "enable RLS and add policies" part of every prompt that creates a table.

Check your whole app in 30 seconds

RLS is one of the checks SafeLaunch runs on your code, alongside leaked keys, master keys in browser code, vulnerable packages and hidden malicious code. Each finding comes with the exact prompt to fix it.

Run a free SafeLaunch scan →