Never use the admin client for reads in server actions
createAdminClient() bypasses RLS. Use it only for writes that need service_role privileges. For reads, use createClient().
Why This Matters
Using the admin client for reads bypasses all access controls. A missing WHERE clause returns all data across all organizations.
Tags
nextjssupabaseserver-actions
Related Rules
Catch this automatically on every PR
BeforeMerge scans your pull requests against this rule and 3+ others. Get actionable feedback before code ships.