IdeaValue

How to Check Supabase RLS: Can Someone Read Other Users' Data with Your anon Key?

By the IDEAVALU team · Updated

Supabase and Firebase let the browser read and write the database directly. That means the database settings are the only thing protecting your data. A table with RLS disabled can be read in full, or rewritten, by anyone who copies the anon key out of your site's JS.

Why a public anon key can still be safe

The anon key lets anyone call the API as a signed-out user. Which rows they can read is decided by each table's RLS policies. With RLS enabled and policies written, holding the anon key gets you only the rows you are allowed to see.

The service_role key, by contrast, is an admin key that ignores RLS and can read and write every row. Never put it in the browser or a public repository.

Find tables with RLS disabled

The Security Advisor (Advisors) in the Supabase dashboard warns about public tables without RLS. You can also run this query in the SQL Editor.

List tables with RLS disabled

select tablename
from pg_tables
where schemaname = 'public'
  and rowsecurity = false;

Enable RLS and write policies

Right after you enable RLS, nobody can read or write the table (except service_role) because there are no policies yet. Add a policy for each operation you need. This example lets signed-in users work only with their own rows.

Enable RLS

alter table public.todos enable row level security;

Users can read, create and update only their own rows

create policy "own rows: select" on public.todos
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "own rows: insert" on public.todos
  for insert to authenticated
  with check ((select auth.uid()) = user_id);

create policy "own rows: update" on public.todos
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

If you use Firebase

Firestore and Cloud Storage control access with security rules. Make sure you did not ship the "anyone can read and write" test rules.

Firestore: users can read and write only their own documents

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/{document=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

FAQ

My app can no longer read data after I enabled RLS
With RLS on, every operation without a policy is denied. Add the policies you need for select, insert, update and delete.
Does this scan check my RLS settings?
From the outside we can only see that a site uses Supabase. Checking which tables are readable would mean accessing someone else's database, so we do not. Check your own project with the SQL above or the Security Advisor.
How to Check Supabase RLS Policies on Your Tables | IDEAVALU