How to check if Supabase RLS is enabled (and fix it)

Why it matters

Supabase exposes every table in the public schema through its REST API. The anon key in your JavaScript is the only thing needed to call it. RLS is what decides which rows that key may see. With RLS off, the answer is all of them.

How to check

• In the dashboard: Table Editor shows a red "RLS disabled" label on unprotected tables.
• In SQL: run the query below to list every public table without RLS.
• From outside: SafeCheck's repo and site scans look for unprotected tables the same way an attacker would.

select tablename from pg_tables
where schemaname = 'public' and rowsecurity = false;

How to fix it

Turn RLS on, then add a policy so each user only sees their own rows:

alter table public.notes enable row level security;

create policy "Users read own notes" on public.notes
  for select using (auth.uid() = user_id);

Never ship the service_role key

The service_role key ignores RLS completely. It belongs only on a server or in an Edge Function. If it ever appeared in your frontend or a commit, rotate it in Project Settings → API.