Supabase RLS: 5 configuration mistakes we find every week
Supabase is powerful. But RLS mistakes are everywhere.
Mistake 1: RLS enabled without policies
Table inaccessible, dev adds service_role client-side.
Mistake 2: SELECT protected, UPDATE/DELETE forgotten
Most common mistake. Any authenticated user can modify others' data.
Mistake 3: USING(true)
Equals no protection. Everyone has access.
Mistake 4: RPC functions without checks
RPC functions bypass RLS by default.
Mistake 5: Storage buckets without policies
Confidential documents in open buckets.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
WordPress REST API: 7 dangerous endpoints enabled by default
Your WordPress exposes sensitive data via REST API without you knowing. Here are 7 endpoints to check now.
Firebase Firestore: why 'allow read, write: if request.auth != null' is not security
The basic Firestore authentication rule doesn't protect your data. Here's why and how to fix it.
Laravel: when Ziggy exposes the complete map of your application
Ziggy route exposure gives attackers a complete map of your Laravel app architecture.
Sources
Editorial analysis based on official vendor, project, and regulator documentation.
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.