If a request to your Supabase table suddenly fails with 42501 "permission denied for table" , the role making the request has no grant on that table. It's a one-line error with a tempting one-line fix, and that fix is exactly what you want to avoid.

TL;DR: Grant only what each role needs, keep RLS on with policies, and never GRANT ALL to anon.

Status as of Oct 26, 2026: the change below hasn't reached existing projects yet. From Oct 30, Supabase is scheduled to apply it to all existing projects.

What Supabase will change

Here's how Supabase's changelog puts it: once the change reaches a project, "new tables you create in public schema require an explicit opt-in (via a Postgres grant ) before the Data API can see them." The Data API is the auto-generated REST and GraphQL layer, the thing supabase-js talks to.

The timeline:

April 28, 2026: new projects could opt in at creation.

May 30, 2026: became the default for all new projects, rolled out gradually over a few weeks.

October 30, 2026: from Oct 30,…