Disclosure: we build SniffPup, a free passive scanner for live sites. This guide was first published on our site. The SQL follows Supabase's own RLS docs and works without our tool.

Short answer: most apps need only a handful of Row Level Security (RLS) patterns:

Pick the one that matches each table below.

Turn RLS on.

Grant each role only what it needs.

Write one policy per operation.

Prove it with a signed-out test and a two-user test.

Rename the tables and columns to match yours, and only test projects you own.

Before any policy: turn RLS on and set the grants

Postgres checks two things. Grants decide whether a role can run an operation on a table at all. Policies decide which rows it applies to. Supabase's docs warn that on projects that still grant anon and authenticated every privilege on new tables, adding policies doesn't take those grants back. So for every table in an exposed schema:

alter table public .…