Supabase
Supabase RLS check
Row-level security, or RLS, is the set of rules for who can see which records. A switch that says the rules are on is not the same as a test that they work.
What still goes wrong when the switch is on
- A table of customer details with rules turned on, and no rule that limits who can read a row.
- A file bucket left so anyone with the link can download it.
- A rule copied from a tutorial that lets every signed-in person read every row.
- A key for the database written into the page, where a visitor can read it.
If those show up, the next step is a Launch-Ready Check and, if you want the repairs, a Fix Sprint. You keep the accounts and the data.
FAQ
Questions worth answering first
What does “RLS on” actually mean?
It means Supabase will use your rules. If a table has no rule, or the rule says anyone can read the rows, the data is still open. The switch does not write the rules for you.
How do you test it?
We sign in as two different people and try to open each other's records, including files. We also try the public link a stranger would use, with your permission. We tell you what opened that should not have.
Can I do a first pass myself?
Yes. The free self-check asks whether people must sign in before private records, and whether one customer can open another's. It is not a test of the database. A Launch-Ready Check is.
Next step
Book a free technical assessment.
Thirty minutes. We look at where you are, whether you are about to build, ready to launch, or already live, and tell you what matters first. You leave with a written next step, whether or not you hire us.
Every price is a custom quote after your assessment. No work starts until you accept the proposal.