Enable Supabase Row Level Security on every table — Cursor

Using a different tool? Pick your stack:

The prompt for Cursor

Copy and paste this into your Cursor chat exactly as-is.

Apply these changes to my codebase. Edit the files directly and keep existing formatting:

Enable Supabase Row Level Security

1. Open the Supabase dashboard → Authentication → Policies.
2. Enable RLS on EVERY table (no exceptions, even ones you think are public).
3. Add explicit policies (e.g. `auth.uid() = user_id`) — RLS without policies blocks everything.
4. Audit your client code: only the anon key should ever reach the browser, never the service_role key.

Why this matters

Common mistakes to avoid

• error_outlineEnabling RLS but forgetting to add a SELECT policy — the table becomes invisible, features break, devs disable RLS again.
• error_outlineWriting a policy with `using (true)` "to get things working" — same as no RLS.
• error_outlineUsing the service_role key in a client-side file because "nothing was working" — bypasses RLS entirely.
• error_outlineAdding RLS only to the tables you think are sensitive — the missed one is always the problem.
• error_outlineEnabling RLS on Supabase auth tables manually — those are managed by Supabase, leave them alone.

How to verify the fix worked

• check_circleIn Supabase dashboard → Authentication → Policies — every non-auth table shows RLS enabled and at least one policy.
• check_circleFrom an incognito browser (unauthenticated), try a `select` on every table — must return 401 or empty results.
• check_circlePantra Security Audit run shows "Supabase RLS: pass" (otherwise it is flagged as critical).
• check_circleSQL query: `select tablename from pg_tables where schemaname='public' and rowsecurity=false` — must return zero rows.

Frequently asked questions