free, nothing stored
Who can read your Supabase tables?
Paste your migrations and see, in plain words, who can read, add, change and delete rows in every table. Nothing connects to your database and nothing is saved.
supabase/migrations/*.sql
Tip: run supabase db pull to get your schema and policies as one SQL file.
your tables show up here
| Table | Anyone | Signed-in users |
|---|---|---|
| profiles | reads everything | changes everyone's rows |
| notes | nothing | only their own |
What it checks
- Tables without row level security, which anyone can read and write with your public key
- Policies with
using (true)that open a table to everyone - Update and delete rules that let any signed-in user change other users' rows
- Database functions with admin rights that anyone can call
Why this matters
Every Supabase app ships its public key in the website, so anyone can call your database. Row level security policies are the only thing that decides which rows each caller may read or change. Apps built with Lovable, Bolt and v0 often have tables without them, or rules that open everything.
How to turn on RLS in a Lovable appa safe owner policy looks like this
alter table public.notes enable row level security; create policy "Users read own notes" on public.notes for select to authenticated using (auth.uid() = user_id); create policy "Users update own notes" on public.notes for update to authenticated using (auth.uid() = user_id) with check (auth.uid() = user_id);