"Write the RLS policy for my users table": three prompts, three outcomes
Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's…
Aliteq
Sam Ortega · Build Editor
The short answer
Row Level Security on Postgres (and Supabase) is deny-by-default: turn it on with no policy and every query returns nothing. The real risk is the opposite mistake — a careless policy like using…
Enabling RLS with no policy denies all access; you must add a per-row policy to let the right people in.
auth.uid() = id is the standard "only your own row" rule; it's a filter added to every query.
A with check clause stops a user from editing their row to impersonate someone else; using (true) exposes everyone.
Aliteq
Read the full story
"Write the RLS policy for my users table": three prompts, three outcomes