Deploy guides

Supabase warns “RLS disabled” — your table is public

You'll see:
  • Supabase dashboard or Security Advisor shows “RLS disabled” / “Table publicly accessible”
  • Lovable's security scan flags a table on publish
  • Anyone with your public (anon/publishable) key can read or change every row

Why it happens

Your Supabase public key is shipped to every visitor's browser — that's by design. Row Level Security (RLS) is what decides which rows each visitor may touch. A table in an exposed schema without RLS is readable and writable by any role that has been granted access to it.

How to fix it

  1. Turn on RLS for the table

    In the SQL editor run this for each table (or toggle RLS in Table Editor). With RLS on and no policies, the public key can no longer read anything — that's expected.

    alter table public.todos enable row level security;

  2. Add policies for exactly what users should do

    Example: signed-in users can see and manage only their own rows. Wrapping auth.uid() in a select is Supabase's recommended pattern for performance.

    create policy "Users read own todos"
on public.todos for select
to authenticated
using ( (select auth.uid()) = user_id );

create policy "Users insert own todos"
on public.todos for insert
to authenticated
with check ( (select auth.uid()) = user_id );

  3. Check views too

    Views bypass RLS by default. On Postgres 15+ create them with security_invoker so the caller's permissions apply.

    create view public.my_view
with (security_invoker = on) as
select * from public.todos;

  4. Test with the public key

    Open your deployed app in a private window while logged out and confirm you can't see other users' data. Re-run the Security Advisor.

Common with:

Related fixes