To test Supabase Row Level Security (RLS), create two test users, add data as user A, then try to read and change it as user B and as a logged-out visitor. If B or a stranger gets A's rows, your policies are too loose. If A can't see their own rows, a policy is missing.

What you need

Your own app, live or on staging with the same database rules.

Two test accounts you create: A and B.

Two browsers, or one normal and one private window.

Step 1: Create data as user A

Sign in as A and create one of everything your app stores: a project, a note, an upload. Open DevTools > Network, reload, and find the request to /rest/v1/... . Note the table and the row id.

Step 2: Try to read A's data as user B

Change the ID in the URL. Open A's page address with A's id. B should get an empty page or an error.

Replay the request. Right-click a similar /rest/v1/ request > Copy as fetch, paste it in the Console and change the filter to id=eq.<A's id> . B should get [] .

Ask for everything. Replay without a user filter.…