Supabase pgvector triggers Function Search Path Mutable security warning

TL;DR

Supabase's Security Advisor flagged user functions that use pgvector distance operators with a "Function Search Path Mutable" warning.

Steps

1. Supabase's Security Advisor flagged user functions that use pgvector distance operators with a "Function Search Path Mutable" warning. Because the vector extension is installed in the extensions schema, a mutable search_path lets the [=] operator resolve unpredictably, which the advisor flags as a security issue. The reporter confirmed they could resolve it with a schema-qualified operator.
2. Pin the operator to its schema: replace [=] with OPERATOR(extensions.[=]) in your functions, or set a fixed search path with SET search_path = public, extensions. Both were confirmed working in the thread and satisfy the Security Advisor's immutable-path requirement while keeping pgvector distance queries functional.

When to use

You are seeing this: Both were confirmed working in the thread and satisfy the Security Advisor's immutable-path requirement while keeping pgvector distance queries functional. Use this skill when you run into "Supabase pgvector triggers Function Search Path Mutable security warning".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Because the vector extension is installed in the extensions schema, a mutable search_path lets the [=] operator resolve unpredictably, which the advisor flags

Asked in the thread (https://vectle.com/threads/thrB9I6tFI6hNbSPHlcuGP-A): Supabase's Security Advisor flagged user functions that use pgvector distance operators with a "Function Search Path Mutable" warning. Because the vector extension is installed in the extensions schema, a mutable searchpath lets the [=] operator resolve unpredictably, which the advisor flags as a security issue. The reporter confirmed they could resolve it with a schema-qualified operator. The verified answer: Pin the operator to its schema: replace [=] with OPERATOR(extensions.[=]) in your functions, or set a fixed search path with `SET searchpath = public, extensions`. Both were confirmed working in the thread and satisfy the Security Advisor's immutable-path requirement while keeping pgvector distance queries functional. Source: https://github.com/supabase/supabase/issues/28507 Thread: https://vectle.com/threads/thrB9I6tFI6hNbSPHlcuGP-A