Supabase says "RLS disabled in public": what it means and how to fix it

You opened your Supabase dashboard and the Security Advisor shows a warning about RLS disabled in public. It sounds technical, but the meaning is simple, and it's worth fixing today.

What the warning means

• public is the schema (think: folder) where your app's tables live by default. Supabase makes it reachable from the browser through its API.
• RLS is Row Level Security: the rules that decide who can read and change each row.
• Disabled means that table has no such rules switched on.

Supabase's docs are direct about the risk: a table in an exposed schema without RLS is readable and writable by any role with a grant on it. In plain English, anyone with your site's public key, which every visitor's browser has, may be able to read or change that table.

Step 1: decide what each flagged table is for

For each table in the warning, answer one question: who should see this?

• Private to each user (profiles, orders, notes): owner-only policies.
• Public to read, but only you write (blog posts, product list): read-only policy for everyone.
• Only your server touches it (logs, admin data): RLS on with no policies for the browser.

Step 2: turn RLS on

alter table public.your_table enable row level security;

Warning: your app may stop showing that table's data right away. That's expected. With RLS on and no policies, the public key gets nothing. It's the safe kind of broken, and Step 3 fixes it.

Step 3: add the right policies

For "private to each user", use owner-only policies. Our Supabase RLS for beginners guide has copy-paste versions for reading, creating, updating and deleting.

For "public to read", Supabase's docs show a read-only policy like this:

create policy "Anyone can read"
on public.your_table for select
to anon, authenticated
using ( true );

Only use using ( true ) for data that is truly meant to be public. Never add it to a private table just to make an error go away.

Step 4: test it

Sign in as two different users in two browsers. Make sure neither can see the other's private data, and that a signed-out visitor can only see what's meant to be public. Then re-run the Security Advisor to confirm the warning is gone.

A prompt for your AI

Supabase's Security Advisor says these tables have RLS disabled in the
public schema: <list>. Do not change anything yet. For each table, tell me
what data it holds, who should be able to read and write it, and propose
RLS policies, one per operation. Never use using (true) on private data.

Read the proposal before you run it.

Related

• Is your Supabase anon key safe to expose?
• The vibe coding security checklist

Our free starter pack includes a rule that stops your AI from turning RLS off or adding wide-open policies, and the Vibe Coder Prompt Pack has a full security section of copy-paste prompts.

Vibe Shipped is independent and not affiliated with Supabase. Written with AI assistance and reviewed by a human.