{
  "id": 16579216,
  "title": "\"new row violates row-level security policy\": why data won't save in Supabase",
  "url": "https://urgent.news/2026/10/26/new-row-violates-row-level-security-policy-why-data-wont-save-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T09:00:44.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/vibefix/new-row-violates-row-level-security-policy-why-data-wont-save-in-supabase-1e00"
  },
  "original_language": "en",
  "account": "When a user submits a form and clicks \"Save\", the data fails to be saved to the database. The error message displayed is \"new row violates row-level security policy for table\". Row-level security (RLS) consists of rules governing which rows a user can access for reading or writing. After enabling RLS, no data is accessible through the API using a publishable key until policies are created.\n\nThe database enforces the table's security by aborting the entire INSERT command if the inserted row does not meet the policy requirements. To resolve this issue, a policy must be added that grants the appropriate permissions for the user or role attempting to write the row. Without a proper policy, the database will prevent the row from being saved.",
  "summary": "A user fills in a form, presses Save, and nothing happens. The console or logs show \"new row violates row-level security policy for table\", followed by the table name. A public example: new row violates row-level security policy for table \"players_secure\" ( supabase/postgres #1708 ). Row-level security (RLS) is a set of rules on each table about who may read or write which rows. Supabase says…",
  "key_points": [
    "User submits form, clicks Save, but data fails to save",
    "Row-level security (RLS) policy violated, preventing data insertion",
    "Adding policy granting appropriate permissions resolves issue"
  ],
  "editors_take": "Enforcing strict row-level security by default turns database policies into essential gatekeepers that can inadvertently block all incoming user data if permissions are not explicitly defined.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}