Supabase tables without Row Level Security are public
With Row Level Security off, or a policy of using (true), the public anon key in your app lets anyone read, change or delete every row. The app still works, which is why nobody notices. What you see Nothing looks wrong: the app works in every test. But anyone can open the browser's developer tools,…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-11-03 09:40 · DEV Community — AI
Supabase tables without Row Level Security are public