The side door: Ember sniffs your Supabase views
You locked the front door with RLS. Ember would like a word about the side door. In Postgres, a view runs with its owner's permissions by default, not the caller's. In Supabase, that owner usually bypasses RLS. So a vie
You locked the front door with RLS. Ember would like a word about the side door.
In Postgres, a view runs with its owner's permissions by default, not the caller's. In Supabase, that owner usually bypasses RLS. So a view in your public schema can hand your anon key rows your table policies were built to hide.
The two-minute check
- List the views in your
publicschema. - On Postgres 15 and up, run
alter view public.my_view set (security_invoker = true);so RLS applies again. Our guide walks through it. - Then scan your own app on SniffPup for other open doors.
Every door counts. Ember checks them all.
Want one 2-minute check like this every morning? Sign up below.
Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.