Supabase: Row Level Security policies explained simply

Question

Supabase keeps warning me that RLS is disabled on my tables. What is RLS, and what's a minimal safe policy for a `notes` table where users only see their own notes?

Accepted Answer

With Supabase, your frontend talks to the database **directly** using the public `anon` key. Without **Row Level Security**, anyone holding that key (i.e. anyone who opens your site) can read or modify **every row**.

RLS adds a filter to every query based on who is asking:

```sql
ALTER TABLE notes ENABLE ROW LEVEL SECURITY;

CREATE POLICY "read own notes" ON notes
  FOR SELECT USING ((select auth.uid()) = user_id);

CREATE POLICY "insert own notes" ON notes
  FOR INSERT WITH CHECK ((select auth.uid()) = user_id);

CREATE POLICY "update own notes" ON notes
  FOR UPDATE USING ((select auth.uid()) = user_id)
  WITH CHECK ((select auth.uid()) = user_id);

CREATE POLICY "delete own notes" ON notes
  FOR DELETE USING ((select auth.uid()) = user_id);
```

Notes:
- With RLS enabled and **no** policies, nothing is accessible. That's a safe default.
- The **service role / secret key bypasses RLS**. Only use it on the server, never in the browser.
- Add an index on `user_id`. Policies run on every query.

1 Answer