The RLS Problem in AI-Generated Apps
Lovable and other AI builders generate Supabase schemas and RLS policies automatically. But in our audits, 72% of AI-generated RLS policies have security gaps.
What Is RLS?
Row Level Security controls who can read/write each row in your Supabase tables. Without proper RLS, any authenticated user can access any data.
Common AI RLS Mistakes
1. No RLS at All
AI sometimes creates tables without enabling RLS. Every table needs RLS enabled.
2. Overly Permissive Policies
-- BAD: any authenticated user can read everything
CREATE POLICY "Enable read" ON tasks FOR SELECT USING (auth.role() = 'authenticated');
-- GOOD: users can only read their own tasks
CREATE POLICY "Users read own tasks" ON tasks FOR SELECT USING (auth.uid() = user_id);
3. Missing Delete Protection
AI often forgets to add delete policies, leaving data open to deletion.
RLS Audit Checklist
For each table in your Supabase project:
- [ ] RLS is enabled
- [ ] SELECT policy scoped to owner or role
- [ ] INSERT policy validates user_id
- [ ] UPDATE policy scoped correctly
- [ ] DELETE policy exists and is restrictive
- [ ] Service role bypass is intentional
The Fix Prompt
"Audit all Supabase RLS policies. For each table, ensure RLS is enabled and policies restrict access to the owning user (user_id = auth.uid()). Add missing policies and report any security gaps."
