Anyone with your Supabase publishable or anon key can read and write a table that has RLS off

Symptom

Rows can be read through the Data API with only the project URL and the publishable or anon key, no sign-inRows can be inserted, changed or deleted by requests your app never madeThe table shows RLS disabled while your app ships the key in its browser code, as it is meant to

Cause

The publishable key (the legacy anon key) is meant to be public, so it only protects data when Row Level Security is on. A table in an exposed schema, such as public, without RLS is readable and writable by any role with a grant on it, and on existing projects new tables in public may start with grants to anon and authenticated.

Fix

Enable RLS on every table in an exposed schema, then add policies for exactly the access each role needs. Once RLS is on, the publishable key reaches no rows until a policy allows it, so write the policies before your app relies on the table.

ApplyCopy

alter table public.todos enable row level security; create policy "owners read their rows" on public.todos for select to authenticated using ((select auth.uid()) = user_id);

Affected

Supabase projects with any table in an exposed schema, usually public, that has RLS disabled

Sources

• https://supabase.com/docs/guides/database/postgres/row-level-security
• https://supabase.com/docs/guides/api/api-keys

Last verified 2026-10-27 · Confirmed by 0 builders