How to enable Supabase Row Level Security (RLS)

Step-by-step: turn on RLS, write auth.uid() policies, and verify strangers cannot read your tables.

Row Level Security is Postgres's per-row access control. With Supabase, the public anon key is meant to be in the browser — safety comes from RLS, not from hiding that key.

Enable RLS on every table

alter table public.profiles enable row level security;

Or in the dashboard: Table Editor → table → toggle RLS enabled.

Typical owner-only policies

create policy "select own" on public.profiles
  for select to authenticated
  using (auth.uid() = id);

create policy "update own" on public.profiles
  for update to authenticated
  using (auth.uid() = id)
  with check (auth.uid() = id);

create policy "insert own" on public.profiles
  for insert to authenticated
  with check (auth.uid() = id);

Avoid using (true) on tables with personal data — that means "everyone can read."

Verify

1. Supabase → Advisors → Security Advisor.
2. From an incognito window (logged out), try the REST API with only the anon key. You should get empty results or 401/403, not other users' rows.

Official docs: Supabase RLS guide.

Enable Row Level Security on every public table. Add SELECT/INSERT/UPDATE/DELETE policies so a user can only touch rows where auth.uid() equals the owner column (id or user_id). Never use USING (true) on tables with PII. Never put the service_role key in the frontend.

Related: Anon key explained · service_role exposure

More guides

• Is my Lovable app secure?
• Exposed Supabase service_role key: what to do now
• Lovable security checklist
• Bolt.new security checklist