DATA & AUTH
Supabase Row Level Security
Write down who can read and change each row before writing a policy. Then check the owner, another user and a signed-out request through the same client path the app will use.
On this page
SupabaseIdentity → policy → role-based checks
01USING and WITH CHECK cover different parts of a write.
02A changed owner ID is a permission case of its own.
03Administrative-key results cannot establish normal-user isolation.
Define the access matrix before SQL
List the table, owner column, operations and roles. Supabase Auth provides user identity, but the RLS policy defines which rows each operation may access. Team membership needs a different model from simple ownership.
Read existing rows and check new values
USING governs row visibility/access; WITH CHECK validates inserted or resulting row values. auth.uid() identifies the request’s user and is null without authentication. A user changing an ownership column is a separate case to consider.
Test realistic request identities
Use user A, user B and an unauthenticated request for read and write cases, including a forged owner ID. Test through the application’s ordinary client path. Elevated secret-key behavior does not demonstrate ordinary-user isolation.
A few more details
Is a sign-in screen enough to protect every row?
No. Authentication identifies a user; authorization policies determine permitted data access.
Why avoid testing only with an administrative key?
Administrative secret-key requests can bypass RLS under documented conditions, so use the intended user role and token for isolation checks.
Sources & maker notes
This guide is based on the cited documentation and maker sources. vibeforthat has not run an independent installation or end-to-end product test for this article.
Related guides & projects
View all
Lovable and Supabase Setup for Auth and Data
You do not need a separate Supabase account for every Lovable app. Connect your own project when you need its dashboard, billing or existing data—and plan the move, because the two backend routes do not migrate automatically.
Read moreClaude Code Security Review
Choose the review surface first: the session command, the PR GitHub Action or the separate Claude Security product. They run at different times and cover different scopes; findings still need investigation.
Read moreSaaS Launch Checklist for the First Customer Journey
Before announcing the product, walk through what the first customer will do—and what happens when it fails. Cover account access, paid states, recovery and the public domain with observable checks.
Read moreClerk vs Supabase Auth for App Data Access
The question is how identity reaches your data. Supabase Auth integrates with its database and RLS; Clerk can also authenticate users for a Supabase backend through the documented third-party-auth route.
Read more