Lovable·FixdatabaseSupabaseintermediate

Supabase RLS Is Exposing User Data in a Lovable App

Quick Answer

Row Level Security is missing, disabled, or configured with policies that allow broader reads than intended. In vibe-coded apps this often happens because the table exists before the access rules are thought through. Start with "Confirm whether RLS is enabled" before making broader code changes.

Quick Fix Summary

Most likely cause	Row Level Security is missing, disabled, or configured with policies that allow broader reads than intended. In vibe-coded apps this often happens because the table exists before the access rules are thought through.
Fastest fix	Confirm whether RLS is enabled
Use this page if	One user can read another user's rows

You're in the right place if...

!One user can read another user's rows
!Private plan or Stripe data is visible in the browser
!Supabase tables work but feel wide open

Why this happens

Fix

Confirm whether RLS is enabled

Open Supabase → Table Editor → your table → RLS. If it is off, any client-side access using the anon key is already too open.

Add owner-based policies

For user-owned data, start with owner-only select/update/delete policies instead of broad authenticated access.

alter table profiles enable row level security;

create policy "Users can read own profile"
on profiles for select
using (auth.uid() = user_id);

create policy "Users can update own profile"
on profiles for update
using (auth.uid() = user_id);

create policy "Users can insert own profile"
on profiles for insert
with check (auth.uid() = user_id);

Retest with two different users

Patch the generated app prompts

Tell Lovable exactly what should be private so future changes do not reintroduce unsafe queries.

Copy this prompt

Audit all Supabase queries in this app and assume each user must only access their own rows unless I explicitly say otherwise. Add or fix the required RLS policies and update any query that bypasses that model.

Prevent this next time

Treat every new table as private by default. In Supabase, write the RLS policy before you trust the app with real users.