FixLoop

The Fix Loop #2: Your next Supabase table will break on Oct 30

October 14, 2026

Hey. This week is mostly one clock: Supabase changes how new tables work on October 30.

What broke (or will)

From the usual Lovable + Supabase pile, three patterns keep showing up:

• Works in preview, dead on the real domain. Auth Site URL and Redirect URLs still point at the Lovable preview link.
• RLS off on a table people can hit with the anon key. (We covered the check in issue #1.)
• The one that matters this week: starting October 30, 2026, new tables in public on existing projects are not exposed to the Data API until you grant them. Existing tables keep working. The first feature you add after that date returns 42501 permission denied for table.

Source: Supabase changelog.

Fix walkthrough: safe grants (not GRANT ALL)

When Lovable (or you) create a table after Oct 30, do all of this in the same migration:

alter table public.notes enable row level security;

create policy "own notes: read" on public.notes
  for select to authenticated using (auth.uid() = user_id);
create policy "own notes: write" on public.notes
  for insert to authenticated with check (auth.uid() = user_id);

grant select, insert, update, delete on public.notes to authenticated;
grant select, insert, update, delete on public.notes to service_role;
-- grant to anon only if signed-out visitors should read that table

Skip GRANT ALL. It can open a table that has no RLS. Policies alone do not fix a missing grant; Postgres checks privileges first.

If you already see 42501, open the network tab, read the hint, then add the smallest grant that matches the role your app actually uses, with RLS on.

Longer write-up: Supabase 42501 after Oct 30 (ships with the guide when that page is live).

Tool worth trying: Cursor on your Lovable GitHub sync

If Lovable keeps "fixing" the same error, sync the project to GitHub and open it in Cursor. Point the agent at the failing network response and the Supabase migration, not another vague "fix auth" prompt. Half the loops die once something can read the real error body.