Guide

Check and fix open Supabase RLS on a Lovable app

Apps built in a hurry often ship with a table anyone can read. This page shows a safe way to check, and a safe way to close it.

What RLS means

Row level security is a switch on a Supabase table. When it is on, a policy decides who can read or write each row. When it is off, the public anon key in your frontend can read the table.

The anon key is not the secret

The anon key is supposed to be in the browser. The service role key is not. If the service role key is in the frontend, rotate it in Supabase and remove it from the app.

Look in Supabase

1. Open the project in the Supabase dashboard.
2. Open Table Editor and pick a table that holds private rows, such as profiles or orders.
3. Turn on RLS if it is off.
4. Open the policies. If a policy says using (true) on a private table, that rule lets everyone through. Replace it with a rule that checks the signed-in user, often auth.uid().

Then run the free check

Paste the public app link into the MondayMedic checkup. If a private-looking table still returns rows, the policy is still too open. We do not change the database for you.

This is a starter note for a longer guide. It is not a full hardening list.