← Guides

Supabase RLS for vibe-coded apps: how to check if your tables are public

Apps generated with Lovable, Bolt, v0 and similar tools usually talk to Supabase straight from the browser with the public anon key. That is fine only if every table has Row Level Security (RLS) turned on with sensible policies. When a table has RLS off, anyone can copy your anon key from the page and read the table.

How to check

1. In the Supabase dashboard, open Database > Tables and look for tables without the RLS badge.
2. Run the Supabase Security Advisor.
3. Check from the outside the way an attacker would: LatchDog's verified deep scan sends one SELECT ... LIMIT 1 per table with your anon key and flags any table that returns a row, without storing any data.

How to fix

alter table public.profiles enable row level security;
create policy "owner can read" on public.profiles
  for select using (auth.uid() = user_id);

Also check views: a view created by the postgres role bypasses RLS unless you set security_invoker = true.