{
  "id": 5524549,
  "title": "Your RLS is on and the table is still readable",
  "url": "https://urgent.news/2026/09/04/your-rls-is-on-and-the-table-is-still-readable",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-04T08:43:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/shipsafescan/your-rls-is-on-and-the-table-is-still-readable-1a7"
  },
  "original_language": "en",
  "account": "Row Level Security (RLS) in databases like Supabase and PostgreSQL with Postgres provides protection by restricting access to sensitive data based on certain conditions. However, if RLS is not properly configured or if policies are improperly set, unauthorized users may still be able to read or manipulate data. The article discusses the importance of checking RLS status, policies, and the correct usage of anon keys to ensure data security.\n\nTo test RLS and policies, the author suggests using curl commands with the anon key to access different tables and verify if data is accessible. There are four common issues that can lead to data being readable by strangers despite RLS being on:\n\n1. RLS is disabled on a table, making it accessible to everyone.\n2. Policies are set to allow all access, effectively disabling any restrictions.\n3. Policies exist but only cover certain commands, leaving some operations unprotected.\n4. The service role key, which bypasses RLS, is included in the client code.\n\nThe recommended solution involves checking each table's RLS status, ensuring policies are in place to protect data, and confirming that all client operations have corresponding policies. Additionally, the service role key should be secured and not included in client code. Regularly reviewing policies ensures that the database remains secure against unauthorized access.",
  "summary": "A while back I wrote up the pass I run over code an assistant wrote for me: secrets in git history, keys leaking into the client bundle, API routes with no guard, stale dependencies, wildcard CORS. Every one of those lives in your application code. There is a layer underneath that, and it fails differently. If you are on Supabase, or any Postgres with Row Level Security, your database is…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}