Row Level Security — Making Sure Users Only See Their Data

Here's a scenario that happens more often than anyone in the industry wants to admit: a developer builds an app, stores user data in a database, and deploys it. Everything works. Users can only see their own data — because the application code filters by user ID.

Then someone opens the browser developer tools, finds the Supabase URL and anon key (which are intentionally public), creates their own Supabase client, and queries the database directly. They get back everyone's data.

The application code was doing the right thing. But the database had no idea who was asking.

This is the problem Row Level Security solves.

What Row Level Security Is

Row Level Security (RLS) is a database-level feature that controls which rows a user can see, insert, update, or delete. Instead of relying o