Description

Ensure every table that has Row Level Security enabled also has at least one policy that defines who can read or change its rows. Tables should not be left with RLS turned on but no policies, unless the table is intentionally meant to be accessible only through server-side code.

Rationale

When RLS is enabled with no policies, the Data API denies all access to the table. This is safe, but it usually means the intended access rules were never written. Teams then often work around it by disabling RLS or using the secret key in the client, which creates a much bigger risk. Defining clear policies keeps access both working and secure.

Impact

  • Makes intended access rules explicit

  • Prevents risky workarounds such as disabling RLS

  • Policies must be tested to confirm they allow only the right rows

Default Value

By default, enabling RLS on a table does not create any policies, so all Data API access to the table is denied.

Pre-Requisites

  • Project Owner, Admin, or Developer role

  • An understanding of who should access each table

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Advisors in the sidebar and select Security Advisor.

  4. Check for the finding RLS Enabled No Policy.

  5. For each listed table, confirm whether access through the Data API is intended.

  6. If a listed table needs API access, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open the SQL Editor in the sidebar.

  4. Create a policy for the table, for example: create policy "Users can read own rows" on public.<table_name> for select to authenticated using ((select auth.uid()) = user_id);

  5. Add policies for any other operations the table needs (insert, update, delete).

  6. Test the policies with a normal user account and rerun the Security Advisor.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open the SQL Editor in the sidebar.

  4. Run: drop policy "<policy_name>" on public.<table_name>;

Reference