Row Level Security (RLS)
Row Level Security (RLS) is access control inside the Postgres database itself: policies decide per data row who may read or change it — for example “only the owner”. Without RLS enabled, every Supabase table the frontend can reach is open to anyone. RLS is the actual security layer of a Supabase app, not the login screen in front of it.
The decisive misconception in many AI-built apps: the login looks secure, so the app feels secure. But the login only governs who sees the interface. The database talks to the frontend directly — and if RLS is not active, anyone with the public anon key can query all rows of all users, completely bypassing the login.
Two failure patterns are typical. First: RLS is not enabled on a table at all — then no restriction applies. Second: RLS is on, but the policy reads “using (true)” — which formally allows everyone everything and is therefore just as open, only harder to spot. Both look identical in the app: it works. It is not secure.
Done right means: RLS enabled on every table, and every policy bound to the user's identity (typically “auth.uid() = user_id”). Our Rescue deep scan checks exactly both — missing RLS and overly permissive “using (true)” policies — and reveals whether anyone actually locked the door behind the login screen.