highaccess-controlconnected project

Write policy without WITH CHECK

MISSING_WITH_CHECK

INSERT and UPDATE policies need a WITH CHECK clause to constrain the rows being written. Without one an attacker can write rows attributed to other users, even when reads are correctly restricted.

What the finding looks like

highPolicy "invoices_write" on public.invoices has no WITH CHECK clause

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by VibeGuard. Review before running in production.
-- Constrain what policy invoices_write is allowed to write.
-- The USING clause is reused as the write check, which is the intent in
-- almost every ownership model. Widen it only if writers are meant to
-- create rows they cannot then read.

ALTER POLICY invoices_write
  ON public.invoices
  WITH CHECK ((( SELECT auth.uid() ) = user_id));

Related guides

What people search for

supabase missing with check policycursor generated supabase missing with checksupabase insert policy without with check

Check your own project

This rule needs a connected project. Start with the free probe to see what is exposed publicly.

Run the free audit