{
  "id": 4240367,
  "title": "Your Supabase anon key can probably read your whole users table",
  "url": "https://urgent.news/2026/08/29/your-supabase-anon-key-can-probably-read-your-whole-users-table",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-29T17:12:57.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mohibakhon/your-supabase-anon-key-can-probably-read-your-whole-users-table-dhf"
  },
  "original_language": "en",
  "account": "Your Supabase anonymous key can likely read the complete users table. This occurs because of a row-level security policy that allows viewing own rows and users who haven't blocked the caller. For callers without a session, the `auth.uid()` returns null, making the condition always true, granting full access. This was explained in a migration that justified a decision, but the policy ended up allowing access to users' schedules. The issue is that the page requires a session, affecting the marketing page's ability to show numbers accurately. To fix this, a function `track_counts()` was created to return only the counts without revealing individual rows. This approach ensures that only the required aggregate data is accessible anonymously, without compromising user privacy.",
  "summary": "Here is a Supabase row-level security policy. It was on a profiles table holding names, timezones and weekly availability for real people. create policy \"profiles are viewable\" on public . profiles for select using ( id = auth . uid () or not public . blocked_with ( id ) ); It reads as: you can see your own row, and anyone who hasn't blocked you. That is what it does — for a signed-in caller. For…",
  "key_points": [
    "Anonymous key can access entire users table",
    "Row-level security policy allows viewing own rows",
    "Function created to return only counts"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}