Tables in the public schema without Row Level Security allow unrestricted access through the API.
Any table in the public schema without RLS is directly accessible via the PostgREST API, exposing all rows to any authenticated or anonymous user.
BeforeMerge scans your pull requests against this rule and 4+ others. Get actionable feedback before code ships.
When a table in the public schema has RLS disabled, every row is accessible through the API. This is the #1 security issue found by Supabase's splinter linter.
Run the Supabase splinter linter:
-- From splinter.sql, lint 0013
SELECT schemaname, tablename
FROM pg_tables
WHERE schemaname = 'public'
AND tablename NOT IN (
SELECT tablename FROM pg_tables t
JOIN pg_class c ON c.relname = t.tablename
WHERE c.relrowsecurity = true
);Or use the Supabase Dashboard → Database → Linter.
ALTER TABLE public.your_table ENABLE ROW LEVEL SECURITY;
-- Then add appropriate policies
CREATE POLICY "authenticated_read" ON public.your_table
FOR SELECT USING (auth.uid() IS NOT NULL);0013 (rls_disabled_in_public)