The side door: Ember sniffs your Supabase views

You locked the front door with RLS. Ember would like a word about the side door.

In Postgres, a view runs with its owner's permissions by default, not the caller's. In Supabase, that owner usually bypasses RLS. So a view in your public schema can hand your anon key rows your table policies were built to hide.

The two-minute check

1. List the views in your public schema.
2. On Postgres 15 and up, run alter view public.my_view set (security_invoker = true); so RLS applies again. Our guide walks through it.
3. Then scan your own app on SniffPup for other open doors.

Every door counts. Ember checks them all.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.