Supabase RLS checker

How to check by hand

• In the Supabase dashboard, open Authentication, then Policies, and look for tables with RLS disabled.
• For tables with RLS on, read each policy. A select policy of "true" means every visitor can read every row.
• Remember views and functions: a view can expose data from a protected table if it is not set up carefully.

How RowLocked checks it

When your site's JavaScript includes a Supabase URL and anon key, our scanner uses that same public key to ask each table it finds for a row count only. If a count comes back, the table is readable by anyone. We never download or store the rows themselves.

The fix

-- Turn on Row Level Security for a table
alter table public.profiles enable row level security;

-- Let signed-in users read and update only their own row
create policy "Own profile read" on public.profiles
  for select using (auth.uid() = id);
create policy "Own profile update" on public.profiles
  for update using (auth.uid() = id);