I ran a security audit on my own Supabase project last week. RLS was enabled. Three policies per table. The dashboard showed everything green.

Every table was wide open to anyone holding the publishable key.

Here's how that happens, and the 10 checks I now run before every launch.

The trap

The Supabase Table Editor shows you data as postgres — which bypasses RLS entirely. So "I can see the rows in the dashboard, and there are 3 policies" tells you exactly nothing about what the anon role sees. I only found it by querying as anon directly:

set role anon ; select count ( * ) from agent_performance ; -- every row. all of them.

Enter fullscreen mode

Exit fullscreen mode

The policies were real. They were also USING (true) — which means "everyone." RLS on ≠ secured.

It got worse on the second project

Different project, 10 tables with RLS disabled outright. The main work_orders table: readable, writable, deletable by anyone with the key.…