How to Fix Missing Row Level Security in Supabase

Missing Row Level Security is not an abstract compliance issue. It is a direct path to users reading or mutating data they do not own.

01. Step 1: Enable RLS on the table

If the table is sensitive and RLS is off, start there:

alter table profiles enable row level security;

That flips the table into a model where policies matter.

02. Step 2: Stop using generic generated policies

One recurring hallucination in vibe-coded Supabase apps is a policy that feels personalized but is actually global:

create policy "Users can read profiles"
on profiles
for select
using (true);

That is not a user policy. It is a public policy with nicer copy.

03. Step 3: Write the ownership condition explicitly

If a row belongs to a user, say that:

create policy "Users can read their own profile"
on profiles
for select
using (auth.uid() = user_id);

For team or tenant data, the logic may need a membership join rather than a direct owner field.

04. [Component: DarkWireframeKey]

The DarkWireframeKey visual should show a table boundary with one green path for a valid user-row match and one red path for a mismatched auth.uid(). That contrast matters because RLS only works when the visual model and the SQL condition say the same thing.

05. Step 4: Review inserts, updates, and deletes separately

Many teams fix select policies and forget the rest.

You may need:

1. 01. using rules for reads and deletes
2. 02. with check rules for inserts and updates

If your write path is tenant-scoped, check that new rows cannot be inserted into another tenant’s space.

06. Step 5: Test the actual edge case

Do not stop at “policy created successfully.” Test:

1. 01. user A reading user B’s rows
2. 02. user A updating another tenant’s record
3. 03. unauthenticated access
4. 04. newly created rows during onboarding

07. Step 6: Re-check the client queries

The app may still fail after you fix RLS because the original scaffold assumed broad access.

That is useful. It forces the queries and joins to align with reality.

08. The correct end state

You are done when:

1. 01. the table has RLS enabled
2. 02. reads are actor-scoped
3. 03. writes are actor-scoped
4. 04. tenant boundaries are explicit
5. 05. the app still works for the authorized path only

That is what “fixed” actually means.