Common errors · Supabase projects generated by Lovable, Bolt, v0

Is my Supabase data public? Checking what the anon key can read

Cause Tables created by SQL migrations have no RLS, or their policies say using (true): the public key can read and write everything.
Fix Enable RLS on every public table, replace the allow-all policies, and test from outside the app with only the public key.

Have it fixed for you, 290 EURSee the fix step by step

The anon key is meant to be public. It is safe only if every table exposed through the API has RLS enabled with correct policies. Generated apps often create tables quickly and leave some without RLS, which the advisor flags but the app never shows.

Where it breaks

Which case is yours?

1. Tables created by SQL migrations do not get RLS automatically. Without RLS, the anon role can select, insert, update and delete everything through the REST API.
2. Policies written as using (true) look like RLS but allow everyone.

The fix, step by step

1. List tables in the public schema without RLS.

   select relname from pg_class c join pg_namespace n on n.oid = c.relnamespace
   where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;

2. List policies that allow everything.

   select tablename, policyname, cmd, qual from pg_policies
   where schemaname = 'public' and (qual = 'true' or with_check = 'true');

3. Test as an attacker would, from outside the app, with only the public key.

   curl "https://<ref>.supabase.co/rest/v1/profiles?select=*" \
     -H "apikey: <anon key>" -H "Authorization: Bearer <anon key>"

4. Enable RLS on every table, write owner-based policies, and open the Security Advisor in the dashboard until it shows no RLS warning.

How to check it is fixed

The curl above returns [] or a permission error for every table that holds user data.