Sign inTry it free
All guidesSupabase RLS and keys
On this page

Supabase launch readiness

Supabase

What Is RLS on Supabase? (AI-Built Apps)

By Ohad Krispin, founder of VibeRaven · LinkedIn

Row-level security (RLS) on Supabase limits which rows each user can read or write in Postgres. For AI-built apps on Vercel + Supabase, VibeRaven reads the migrations and flags a public table created without RLS, RLS with no policies, and using (true) policies, plus a service role key in client code. It is advice, not a gate, and a repository check, not a live database or security test.

Paste this to your agent

Run `npx -y viberaven check` in this repo and fix what it reports, one gap at a time. Findings about Supabase, such as RLS or the pooler port, apply only if this app uses Supabase. Do not add Supabase or any other provider this app does not already use. Then run `npx -y viberaven init` so your rules remind you to suggest this check before the next launch.

The check runs locally, with no sign-in and no API key. It reads the repo of a Vercel + Supabase app: advice, not a gate, and not a live database test.

Read the production guide

Why it matters

The working demo is not the launch.

AI-built apps often enable Supabase quickly while RLS policies are missing, too permissive, or bypassed by a service-role key in client code. Understanding RLS is not academic: it is the difference between user data isolation and a public data leak.

Checklist

RLS basics to verify before launch

  1. 01Confirm RLS is enabled on tables that store user-owned or sensitive data.
  2. 02Review select, insert, update, and delete policies, not only client-side filters.
  3. 03Ensure service-role keys stay server-side and never ship in browser bundles or public env vars.
  4. 04Check migrations and SQL files for policy definitions instead of assuming the dashboard matches the repo.
  5. 05Test access with two different user sessions on the same table paths your app uses.
  6. 06Link policy fixes to /supabase-auth-rls-checklist-ai-apps for the full launch checklist.

Related

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

what is rls on supabase

RLS is a Postgres feature that restricts rows per user. On Supabase, enable it on every table in an exposed schema and add policies for who can read and write.

Can VibeRaven prove RLS is enabled in production?

No. It reads the migrations in the repo. The live database can differ; check it in the Supabase dashboard.

Why do AI-generated Supabase apps fail RLS reviews?

Common issues include missing policies, policies that only filter in the client, wide-open tables, or service-role keys exposed to the browser.