"RLS enabled" isn't the same as private.
Updated 26 October 2026 · Postlaunch
Row-Level Security only protects data if the policies are right. Many AI-built apps have RLS switched on but a policy like USING (true), which lets every signed-in user, or every visitor, read or change every row. Check three things: tables with RLS off, policies with USING (true) or WITH CHECK (true), and whether two unrelated users can reach each other's rows.
Why this keeps happening
When an AI builder hits a permissions error, the quickest change that makes it disappear is a policy that allows everything. The app works, the dashboard says "RLS enabled", and nobody notices that customer B can read customer A's data. In 2025 a researcher found broken or missing rules in about 10% of 1,645 Lovable apps scanned (CVE-2025-48757, disputed by Lovable).
Check it in 2 minutes
Run our free, read-only leak check in your Supabase SQL editor. It lists tables with RLS off (and whether visitors can read them), policies that let everyone through, functions anyone can call with owner rights, and public storage buckets.
What a safe policy looks like
-- each user sees only their own rows create policy "own rows" on public.notes for select to authenticated using (user_id = (select auth.uid())); -- team data: only members of the row's workspace create policy "members read tasks" on public.tasks for select to authenticated using (public.is_workspace_member(workspace_id));
Write separate policies for reading and for changing data, and add with check on inserts and updates so users can't write rows that belong to someone else, or change their own role or plan.
What the script can't tell you
A policy can look specific and still be wrong for your business: a membership table users can add themselves to, an admin flag users can set, an ID that can be swapped in a request. That needs a person signing in as two customers and a stranger, which is exactly what our Security Snapshot does.
Want it done for you?
$290 Data lockdown · fixed price · 2 business days
Questions
My Supabase dashboard says RLS is enabled. Is my data safe?
Not necessarily. RLS enabled only means policies are enforced. A policy written as USING (true) lets every signed-in user, or every visitor, reach every row, so the table is effectively public.
What does USING (true) mean in a Supabase policy?
It means the condition is always true, so the policy allows the action on every row for the roles it applies to. AI builders often generate it to make an error go away.
How do I test RLS properly?
Sign in as two unrelated users and a logged-out visitor and try to read and change each other's rows, including by changing IDs in requests. Our free leak check finds the obvious problems; a person is needed to test the business logic.
What does it cost to fix?
Our Data lockdown is $290 at a fixed price. A Security Snapshot that tests the whole app as two customers and a visitor is also $290 and is credited to any fix.
Sources: Supabase: Row-Level Security · NVD: CVE-2025-48757