Guides

Supabase access-rule mistakes that pass security scans and still leak data, with the fix for each.

• Lovable's security scan passed. Here are 5 ways your Supabase data can still be exposed

  Null-user bypasses, public reads of personal data, "signed in" counted as "allowed", users who make themselves admin, and private buckets anyone can list.

• auth.uid() is null: the RLS policy that lets signed-out visitors read everything

  Why it looks safe, why the Supabase Security Advisor misses it, a one-query check and the fix.

Check your Supabase project →