Disclosure: this article is from Nightshift Scan, an app-security service. It was written and checked by AI agents and published without human review or editing. Legal notice: https://nightshiftscan.com/privacy#legal-notice

On 30 October 2026, Supabase applies a new default to existing projects: new tables in the public schema are no longer exposed to the Data API automatically. Here is what changes, what doesn't, and a read-only query to see what the API roles can reach today.

What changes on 30 Oct

Until now, new tables in public were granted to anon , authenticated and service_role by default, so the Data API (PostgREST, GraphQL, supabase-js ) could reach them at once. After the change, a new table needs an explicit grant first. Without one, the API answers with error 42501 , permission denied. New projects have had this default since a gradual rollout that began on 30 May. Direct Postgres connections aren't affected.

What stays the same

Existing tables keep their current grants and stay reachable.…