Supabase's Oct 30 grants change: what breaks, and the fix that leaks
If you ship on Supabase, there's a platform change on October 30, 2026 worth five minutes of your time. Short version: a new table in public will no longer be reachable by the Data API until you GRANT it. Existing tables keep working. The trap is the quick fix for the error it throws — it can re-expose every table you have with RLS off. This is a cross-post. The original, with the full SQL and a…
On October 30, Supabase will make a change that affects how tables are accessible via the Data API. Starting from that date, new tables created in the public schema will no longer have default grants granted to the anon role, authenticated users, and service_role. This means that any new tables created without a GRANT will be invisible to the Data API.
Existing tables are not affected by this change and will continue to work as before. However, the catch is that the quick fix for any permission errors that arise from this change can inadvertently grant access to all tables in the public schema, including those that were not intended to be exposed. This could potentially expose sensitive data to anyone holding the anon key, which is included in the frontend of your application.
To avoid this issue, it is recommended to grant permissions on a per-table basis, only providing the necessary privileges to each role. This can be done by creating the table with the appropriate settings and then setting up the required row-level security (RLS) policies and grants. Additionally, it's important to treat the grant, RLS, and policies as a single unit within a migration, ensuring that a table is properly configured before it is created.
To check what the API roles can currently access, you can run a SQL query that lists all tables and views in the public schema, indicating whether they are accessible by anon or authenticated users, and whether RLS is enabled on them. By using this query, you can identify any tables that are accessible by the anon role without RLS enabled, which could lead to unintended data exposure.
To prevent this issue from recurring, two free tools can be used: npx airlock-migrate and npx airlock-rls. The first tool checks your migration files for any mistakes, such as creating tables without enabling RLS or turning it off for existing tables. The second tool scans your live database for any tables with RLS disabled or overly permissive policies, helping to identify any potential security vulnerabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
