修正 Supabase Security Advisor 的「RLS is disabled」警告

You open your Supabase dashboard and see a warning. The Security Advisor tells you "RLS is disabled" for one or more tables. You might also see a yellow unlock icon next to a table name in the editor.

This happens because new tables in Supabase default to having Row Level Security turned off. Your web app uses a public anon key to talk to the database. This key lives in your frontend code. In Next.js, it starts with NEXT_PUBLIC_. In Vite-based tools like Lovable or Bolt, it starts with VITE_. Because this key is public, anyone can find it in their browser network tab. If RLS is disabled on a table, anyone with that public key can read, edit, or delete every record in your database.

1. The table was created manually without RLS

When you create a table in the Supabase interface, there is a checkbox to enable Row Level Security. It is easy to skip this step.

To confirm this is the problem, check the policies page in your project settings. If a table says RLS is disabled, this is the root cause.

Fixing it requires turning the feature on and telling the database what is allowed:

• Click the Enable RLS button next to your table name.
• Test your web app. It will show no data, because an empty RLS configuration blocks all access.
• Click New Policy and choose the option to create a policy from scratch.
• Select the SELECT operation.
• In the SQL expression box, type true.
• Save the policy.

Now your app can read data safely. Because you only created a SELECT policy, users cannot insert or delete data.

2. An AI builder generated the table without security

AI tools often write database creation scripts that skip security rules to get the app working quickly.

If the table has a user_id column meant to track ownership, but the Security Advisor flags it for disabled RLS, the AI left your data unprotected.

You need to restrict data access so users only see and edit their own rows:

• Go to the policies settings.
• Click New Policy for your table and start from scratch.
• Select the SELECT operation.
• In the expression box, type auth.uid() = user_id.
• Save the policy.

This tells Supabase to check the logged-in user's unique ID. It will only return rows where that ID matches the user_id stored in the database.

You must create separate policies for users to add or modify their data. Create a new policy for the INSERT operation using the exact same auth.uid() = user_id expression. Repeat this process for the UPDATE operation.

3. You disabled RLS to fix a bug

Sometimes developers turn off RLS because a strict database query is failing. If you disabled it to test a feature and left it off, the Security Advisor will flag it.

If this is a server-side script or a server action taking place outside the browser, you might be trying to access data that the current user does not own.

If you have server-side code that needs to bypass RLS, never disable RLS on the table itself. Instead, your backend code should use the Supabase service_role key. This key bypasses all RLS policies automatically.

The service_role key must only be used on a secure server environment. It must never be exposed to the browser. Do not put it in variables starting with NEXT_PUBLIC_ or VITE_. Turn RLS back on for your table immediately, then update your backend scripts to use the service key.

Still stuck?

If your app is rejecting valid database requests or exposing data it should not, this is the kind of fix I do.

FAQ

Why does my app stop showing data when I enable RLS?

Enabling RLS blocks all read and write access to the table by default. You have to create specific policies that explicitly allow your app to read or modify the data.

Can I hide my Supabase anon key so I do not need RLS?

You cannot hide client environment variables that start with NEXT_PUBLIC_ or VITE_ because they are bundled into your frontend code. You must use RLS to secure your database against people finding and using this public key.

How do I let users edit their own data?

Enable RLS and create an UPDATE policy using the expression auth.uid() = user_id. This ensures the database only permits changes if the requesting user matches the owner of the row.

Originally published at watershowdigital.com/blog/fix-supabase-rls-disabled-warning. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.