Supabase Auth in Vibe-Coded Apps: Row Level Security You Forgot to Enable

What Row Level Security Is and Why It Matters

Row Level Security (RLS) is PostgreSQL's built-in access control system that restricts which rows a user can access in each table. In Supabase, the client library connects directly to your PostgreSQL database using a public API key. Without RLS, any authenticated user can query any row in any table using the Supabase client.

According to Supabase's own documentation, RLS is the primary mechanism for securing data access in Supabase applications. Yet in practice, AI coding tools generate Supabase client code without creating the corresponding RLS policies. The app works - every query returns data - but there is zero data isolation between users.

The 2024 Verizon Data Breach Investigations Report found that broken access control was the number one web application vulnerability category, responsible for 94% of tested applications having some form of broken access control. Missing RLS in Supabase is the textbook example of this vulnerability.

The Default State: No Protection

When you create a new table in Supabase, RLS is disabled. This means the anon key and any authenticated user's key can perform any operation on any row.

// ❌ BAD - Without RLS, this returns ALL users' messages
const { data } = await supabase
  .from('messages')
  .select('*');
// Returns messages from every user, not just the current user

// Even worse - anyone can delete anyone's data
await supabase
  .from('messages')
  .delete()
  .eq('id', anyMessageId);  // No ownership check

-- ✅ GOOD - Enable RLS and create proper policies
ALTER TABLE messages ENABLE ROW LEVEL SECURITY;

-- Users can only see their own messages
CREATE POLICY "Users read own messages" ON messages
  FOR SELECT USING (user_id = auth.uid());

-- Users can only insert messages as themselves
CREATE POLICY "Users insert own messages" ON messages
  FOR INSERT WITH CHECK (user_id = auth.uid());

-- Users can only delete their own messages
CREATE POLICY "Users delete own messages" ON messages
  FOR DELETE USING (user_id = auth.uid());

How AI Tools Get Supabase Auth Wrong

AI coding tools make three consistent Supabase auth mistakes:

1. Client-side filtering instead of RLS: The code adds .eq('user_id', userId) to queries, creating the illusion of data isolation. But an attacker can remove this filter by calling the Supabase API directly.
2. Using the service role key on the client: The service role key bypasses RLS entirely. AI tools sometimes use it in client-side code, giving every user full database admin access.
3. Missing policies for specific operations: Even when RLS is enabled, policies for UPDATE and DELETE operations are often missing. Users can read only their data but modify anyone's.

// ❌ BAD - Client-side filtering is NOT security
const { data } = await supabase
  .from('profiles')
  .select('*')
  .eq('user_id', currentUser.id);  // Attacker can just change this ID

// ❌ VERY BAD - Service role key in client code
const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL,
  process.env.NEXT_PUBLIC_SUPABASE_SERVICE_KEY  // Bypasses ALL RLS
);

Testing Your RLS Policies

You can verify your RLS setup directly in the Supabase SQL editor:

-- Check which tables have RLS enabled
SELECT tablename, rowsecurity
FROM pg_tables
WHERE schemaname = 'public';

-- Test as a specific user (replace with a real user ID)
SET request.jwt.claims = '{"sub": "user-uuid-here"}';
SELECT * FROM messages;  -- Should only return this user's messages

How to Fix Your Supabase App

1. Audit every table: Go to Table Editor in Supabase dashboard. If any table shows "RLS disabled", fix it immediately.
2. Enable RLS on all tables: ALTER TABLE tablename ENABLE ROW LEVEL SECURITY;
3. Create policies for each operation: SELECT, INSERT, UPDATE, DELETE. Do not assume one policy covers all operations.
4. Remove the service role key from client code: Search your frontend code for service_role or the service key value. Move it to server-side only.
5. Scan your codebase: Tools like VibeDoctor (vibedoctor.io) automatically detect missing authentication patterns and exposed credentials in your Supabase-backed app. Free to sign up.

FAQ