VibeGuard
Free audit
Detection rules
criticalaccess-controlconnected project

Policy always evaluates to true

RLS_TAUTOLOGY

A permissive policy whose expression is a constant true grants the whole table to every role it targets. RLS is enabled, so the dashboard reports the table as protected while it is wide open.

What the finding looks like

criticalPolicy "public_read" on public.invoices always evaluates to true

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by VibeGuard. Review before running in production.
-- Policy 'public_read' grants every row on public.invoices to: anon, authenticated.
-- Replace it with an owner-scoped equivalent:

DROP POLICY public_read ON public.invoices;

CREATE POLICY public_read
  ON public.invoices
  FOR SELECT
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

Related guides

What people search for

fix USING (true) rls policy supabasesupabase rls bypassoverly permissive rls policy

Check your own project

This rule needs a connected project. Start with the free probe to see what is exposed publicly.

Run the free audit