Scan rule · RSC-SEC-050
Tables without Row Level Security
Collects every `create table` and every `enable row level security` across all migrations and reports tables that are never protected.
Why this matters
Row Level Security is access control inside the database itself: policies decide per row who may read or change it. If RLS is not enabled on a table, there is simply no restriction for that table.
The underlying misconception is common: the login looks secure, so the app feels secure. But the login only governs who sees the interface. The database talks to the browser directly — and without RLS anyone with the public anon key can query all rows of all users, straight past the login.
We report this from your migration files: if a table is created without RLS ever being enabled for it, it shows up here. Fix: enable RLS for every table and add at least one policy binding access to the signed-in user.
Scan tier
How to fix it
Enable RLS for each table and add at least one user-scoped policy.