- Home
- The 17 checks
- A database policy lets anyone write
🗂️ Your users' data · Fix now (SEV-1)
A database policy lets anyone write
In plain English: Your table has a lock (row level security), but one of its rules says "yes" to everyone. That means a stranger can add, change or delete your data.
What happens if you ship it
Row level security is on, but this policy says yes to everyone, so a stranger can edit or delete your data.
How to fix it technical
Replace true with a real condition, such as auth.uid() = user_id, on both the using and with check clauses.
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Prompt for your AI tool
Fix this problem in my project: A database policy lets anyone write. Replace true with a real condition, such as auth.uid() = user_id, on both the using and with check clauses. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as rls-open-write, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
What does "using (true)" mean in a policy?
It means the rule always passes, for everyone, including people who are not logged in. It turns the lock into an open door.
What should the policy say instead?
Usually that the logged-in person owns the row, such as auth.uid() = user_id, for both reading and writing.