Supabase tables readable by anyone with no login
A scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.
What it is
A self-reported r/vibecoding scan (August 2026) ran nine external checks on 30,998 live apps built with Lovable, Bolt, v0, Replit and Base44. Of Supabase-backed apps where the check got an answer, 2,096 of 3,680 (57%) served rows to an unauthenticated request; in 394 the readable table was users, profiles or orders.
Escape’s 2025 report on vibe-coded apps likewise found a significant portion of issues in Supabase-backed apps stemmed from misconfigured or missing RLS.
In September 2026, UpGuard checked about 300,000 sites using Supabase and found 16,326 databases with readable tables, over half with signs of personal data (separate entry linked below).
How to check
- List every table and confirm RLS is enabled (SQL below).
- Look for policies using USING (true) on sensitive tables: that is effectively public.
How to fix
- Enable RLS everywhere, then replace permissive policies with ones scoped to auth.uid().
- Keep truly public content (e.g. blog posts) in separate tables from user data.
-- Tables in "public" with RLS turned off
select relname as table_name
from pg_class c join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;
-- Policies that allow everything
select tablename, policyname, qual
from pg_policies
where schemaname = 'public' and qual = 'true';