{
  "id": 15343756,
  "title": "Supabase's Oct 30 grants change: what breaks, and the fix that leaks",
  "url": "https://urgent.news/2026/10/18/supabases-oct-30-grants-change-what-breaks-and-the-fix-that-leaks",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-18T04:00:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mateuszingano/supabases-oct-30-grants-change-what-breaks-and-the-fix-that-leaks-28j9"
  },
  "original_language": "en",
  "account": "On October 30, Supabase will make a change that affects how tables are accessible via the Data API. Starting from that date, new tables created in the public schema will no longer have default grants granted to the anon role, authenticated users, and service_role. This means that any new tables created without a GRANT will be invisible to the Data API.\n\nExisting tables are not affected by this change and will continue to work as before. However, the catch is that the quick fix for any permission errors that arise from this change can inadvertently grant access to all tables in the public schema, including those that were not intended to be exposed. This could potentially expose sensitive data to anyone holding the anon key, which is included in the frontend of your application.\n\nTo avoid this issue, it is recommended to grant permissions on a per-table basis, only providing the necessary privileges to each role. This can be done by creating the table with the appropriate settings and then setting up the required row-level security (RLS) policies and grants. Additionally, it's important to treat the grant, RLS, and policies as a single unit within a migration, ensuring that a table is properly configured before it is created.\n\nTo check what the API roles can currently access, you can run a SQL query that lists all tables and views in the public schema, indicating whether they are accessible by anon or authenticated users, and whether RLS is enabled on them. By using this query, you can identify any tables that are accessible by the anon role without RLS enabled, which could lead to unintended data exposure.\n\nTo prevent this issue from recurring, two free tools can be used: npx airlock-migrate and npx airlock-rls. The first tool checks your migration files for any mistakes, such as creating tables without enabling RLS or turning it off for existing tables. The second tool scans your live database for any tables with RLS disabled or overly permissive policies, helping to identify any potential security vulnerabilities.",
  "summary": "If you ship on Supabase, there's a platform change on October 30, 2026 worth five minutes of your time. Short version: a new table in public will no longer be reachable by the Data API until you GRANT it. Existing tables keep working. The trap is the quick fix for the error it throws — it can re-expose every table you have with RLS off. This is a cross-post. The original, with the full SQL and a…",
  "key_points": [
    "On October 30, Supabase changes table accessibility via Data API.",
    "New public schema tables no longer get default grants for anon, authenticated users, servicerole.",
    "Quick fix may inadvertently expose sensitive data to anyone with anon key."
  ],
  "editors_take": "Supabase's shift toward stricter default permissions forces developers to adopt more granular security workflows to prevent accidental data exposure caused by overly broad permission fixes.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}