← BlogFix prompt3 min readUpdated 2026-08-03

Prompt: turn on Supabase Row Level Security properly

Enables RLS everywhere and — importantly — catches the USING (true) policies that pass naive checks.

Row Level Security is what stops a browser key reading your whole database. The failure mode that matters is not a missing policy but a meaningless one: a policy of USING (true) exists, passes any check that looks for existence, and allows everyone.

Copy this into Cursor, Claude Code, Lovable or your builder
Audit and fix Row Level Security across my entire Supabase project.

For every table in the public schema:
1. Enable RLS: ALTER TABLE <table> ENABLE ROW LEVEL SECURITY;
2. Print the existing policies with their full USING and WITH CHECK clauses.
3. Flag as broken any policy that is unconditional (USING true), or that
   relies on a value the client can change, such as a role stored in
   editable user metadata.
4. Replace broken policies with ownership checks:
   USING ((select auth.uid()) = user_id)
   Use the subselect form — bare auth.uid() is re-evaluated per row and
   becomes a performance problem on large tables.
5. Cover all four commands, not just SELECT: INSERT, UPDATE and DELETE need
   their own policies, with WITH CHECK on the write paths.
6. For tables no browser client should touch (billing, audit logs, internal
   config), enable RLS and create no policy, so they deny by default.

Finish with a table: table name, RLS on/off, policies per command, and
whether an anonymous user could still SELECT from it.

What your AI should do with it

  • Every table has RLS enabled, not just the ones the app queries.
  • Any USING (true) policy is removed and replaced, rather than left in place alongside a new one.
  • Write operations are covered, not only reads.
  • You get an explicit list of what changed, so you can spot a table it misjudged.

How to check it worked

Query your own database anonymously — it should return []

curl "https://YOUR-PROJECT.supabase.co/rest/v1/profiles?select=*&limit=3" \
  -H "apikey: YOUR_ANON_KEY" \
  -H "Authorization: Bearer YOUR_ANON_KEY"

This is one check out of 40+

Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.

Check my site — free