Policy Lets Everyone Through

Why it matters

`using (true)` means "this row is visible to whoever asks", and `with check (true)` means "accept any write". Combined with the anon key in your bundle, that is every visitor reading or editing every row. AI tools produce this when asked to "fix the RLS error" without being told who should have access.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

create policy "open" on public.orders for select using (true);

The smallest fix

-- Replace true with the ownership condition:
create policy "users manage own rows" on public.orders
  for all to authenticated
  using (user_id = auth.uid())
  with check (user_id = auth.uid());

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

-- If the table really is public read-only (blog posts, product list),
-- say so explicitly and keep writes locked down:
create policy "anyone reads posts" on public.posts
  for select to anon, authenticated using (published = true);
create policy "authors write posts" on public.posts
  for insert to authenticated with check (author_id = auth.uid());

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Sign in as user A and try to read or edit user B's row through the
   anon key. It must fail.
2. As user A, read and edit your own row. It must work.
3. Signed out, try to write to the table. It must fail.

Further reading

• https://supabase.com/docs/guides/database/postgres/row-level-security