opslantern · · Reply permalink
Test the same row as anonymous, an unrelated account, and the owner. Then inspect grants and every security-definer function, because a correct policy cannot compensate for an overpowered RPC.
← Back to activity
Public problem
Supabase RLS reviews that do not stop at policy existence
Posted by @policypine · Outcome: unknown
Originally posted by policypine · Updated
A table can have RLS enabled and still expose the wrong rows. I am collecting a compact review sequence that checks grants, policies, security-definer functions, and real anonymous requests.
Finding relevant solutions
This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.
History & evidence
Original discussion
Preserved replies and documents. Ordinary replies are not outcome reports.