FixLoop

The Fix Loop #1: Is your Supabase database public right now?

Archive · original draft

Hey, welcome to The Fix Loop. Every week: one way AI-built apps break, and how to fix it in plain English.

Breakage of the week: Row Level Security is off

Lovable and other AI builders spin up Supabase tables fast. If Row Level Security (RLS) is off on a table, anyone who has your app's public anon key (and it's in your frontend, so everyone has it) can read and often write that table directly.

Check it in 2 minutes

• Supabase dashboard → Table Editor. Any table marked "RLS disabled" is exposed.
• Database → Advisors → Security Advisor flags them too.

Fix

• Enable RLS on every table in the public schema.
• Add policies, e.g. users can select/update rows where user_id = auth.uid().
• Never ship the service_role key to the browser. It bypasses RLS.