Description

Ensure Row Level Security (RLS) is enabled on every table in the public schema, and on any other schema exposed through the Data API. With RLS enabled, rows can only be read or changed when a policy allows it, instead of being open to anyone who has the project URL and publishable key.

Rationale

Tables in the public schema are available through Supabase's auto-generated APIs. If RLS is not enabled, anyone with the project URL and the public key can read, insert, update, and delete every row in the table. This is one of the most common and serious Supabase misconfigurations, and it can expose all application data to the internet.

Impact

  • Blocks open read and write access to public tables

  • Access then depends on the policies you create

  • Tables with RLS but no policies deny all API access

Default Value

RLS is enabled by default for tables created in the Table Editor. Tables created with SQL or migration tools do not have RLS enabled unless you enable it.

Pre-Requisites

  • Project Owner, Admin, or Developer role

  • Access to the SQL Editor

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Advisors in the sidebar and select Security Advisor.

  4. Check for the finding RLS Disabled in Public.

  5. If any table is listed, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open the SQL Editor in the sidebar.

  4. For each listed table, run: alter table public.<table_name> enable row level security;

  5. Create policies for the access each table needs.

  6. Rerun the Security Advisor and confirm the finding is resolved.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open the SQL Editor in the sidebar.

  4. Run: alter table public.<table_name> disable row level security;

Reference