- Home
- The 17 checks
- A database table has no row level security
A database table has no row level security
In plain English: Row level security is Supabase's lock that decides who can see each row of a table. This table has no lock, and the public key that unlocks your database is inside your website, so anyone can read everything in it.
What happens if you ship it
Anyone with your public Supabase key can read this table. That key ships in your JavaScript.
How to fix it technical
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Fix this problem in my project: A database table has no row level security. Add "alter table <name> enable row level security;" in a new migration, then write a policy that limits each row to its owner. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as rls-missing, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
What is row level security in Supabase?
A set of rules on each table that decides which rows a person can see or change, for example "users can only see their own orders". Without it, the public key can read the whole table.
How do I turn on RLS?
Enable row level security on the table, then add a policy, such as only letting a user read rows where user_id matches their login. Supabase's own security advisor in the dashboard can confirm it.