Supabase had granted anon TRUNCATE on 96 tables. I never wrote that line, and every check I own was green.
Read on: the blind spot a non-homologous model caught · 繁體中文版 Do this first, it takes fifteen seconds Paste this into your Supabase SQL editor: SELECT grantee , privilege_type , count ( * ) AS n FROM information_schema . role_table_grants WHERE table_schema = 'public' AND grantee IN ( 'anon' , 'authenticated' ) AND privilege_type IN ( 'TRUNCATE' , 'TRIGGER' ) GROUP BY 1 , 2 ORDER BY 1 , 2 ; If it…
On August 4, 2024, Supabase granted the TRUNCATE privilege on 96 tables to the anon user. The reporter, who had never written any such grants, discovered this when checking privileges on their articles table. The TRUNCATE command is a table-level privilege and is not governed by row-level security (RLS), which is why the reporter's policies did not block it.
The issue originated from Supabase's public schema, which automatically grants TRUNCATE to anon and authenticated users when a new table is created. The reporter's fix revoked TRUNCATE and TRIGGER privileges from anon and authenticated users on all tables, but a loop missed views and their verification query could not detect this oversight.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
