highaccess-controlconnected project

RLS enabled but no policies

RLS_NO_POLICIES

With RLS on and zero policies, Postgres denies every row to non-owner roles. Data is safe but the table is functionally unreachable from the client, which usually means the setup was left half-finished.

What the finding looks like

highpublic.invoices has RLS enabled but no policies

How to fix it

This is real generator output, not a template — a scan substitutes your schema, table and inferred ownership column.

-- Generated by VibeGuard. Review before running in production.
-- RLS is already enabled on public.invoices;
-- it has no policies, so every row is denied. Add the access you intend:

CREATE POLICY invoices_select_own
  ON public.invoices
  FOR SELECT
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_insert_own
  ON public.invoices
  FOR INSERT
  TO authenticated
  WITH CHECK (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_update_own
  ON public.invoices
  FOR UPDATE
  TO authenticated
  USING (user_id = (SELECT auth.uid()))
  WITH CHECK (user_id = (SELECT auth.uid()));

CREATE POLICY invoices_delete_own
  ON public.invoices
  FOR DELETE
  TO authenticated
  USING (user_id = (SELECT auth.uid()));

Related guides

What people search for

supabase rls enabled but no policiespostgrest 401 unauthorized public tablesupabase table returns empty array rls

Check your own project

This rule needs a connected project. Start with the free probe to see what is exposed publicly.

Run the free audit