Access control and data isolation
Policy that allows everything
Row-level security is enabled but the policy condition is true for everyone, so isolation exists in name only.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · API (the interface other software calls; tested directly, without the UI in between)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
A policy with a permissive condition makes failing queries pass, and generated fixes optimise for the query working. The CVE for generated sites was filed as an insufficient policy, not a missing one.
CVE-2025-48757 (CVSS 9.3, critical): an insufficient database row-level security policy in Lovable through 2025-04-15 allowed remote unauthenticated attackers to read or write arbitrary database tables of generated sites.
Source: NIST National Vulnerability Database, 2025-05-30 · verified 2026-09-21
A table in an exposed schema without row-level security is readable and writable by any role with a grant on it; the service_role key bypasses RLS and must stay server-side.
Source: Supabase docs, 2026-09 · verified 2026-09-21
How we detect it
Read every policy expression; run the two-user test on every table.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Supabase
Checklist items that catch it
Policies deny cross-tenant reads and writes when tested as another user
automated For every table or collection, sign in as user A, create a row, then as user B attempt select, update and delete on it through the client API.
User B receives zero rows on select and a permission error on update and delete, for every table.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in access control and data isolation
- critical
- critical
- critical
- critical
- critical
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.