Ship It Checklist

Checklists /Lovable + Supabase /Security

Critical

Turn on row level security for every public table

Lovable often creates Supabase tables that the browser can reach with the anon key. If row level security is off, anyone who can see that key can read or change every row. Generated projects have shipped with open tables, so this is the first check.

How to check

  1. Open the Supabase project Lovable created and go to Table Editor.
  2. Open each table in the public schema. Confirm the row level security label says it is enabled.
  3. In SQL Editor, run: select relname, relrowsecurity from pg_class where relnamespace = 'public'::regnamespace and relkind = 'r';
  4. Every application table should show relrowsecurity as true. Then try the live site in a private window while signed out. You should not see other people's rows.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features. Make the smallest change that closes open database access.

Goal: every table in the public schema that the app uses must have row level security enabled, plus policies so a signed-in user can read and write only their own rows.

Steps:
1. Find the Supabase client and list every table the app reads or writes.
2. Add a SQL migration that runs ALTER TABLE ... ENABLE ROW LEVEL SECURITY on each of those tables.
3. Add SELECT, INSERT, UPDATE and DELETE policies. Use auth.uid() matched to the owner column (often user_id). If a table has no owner column, stop and tell me which table, rather than writing a policy that allows everyone.
4. Do not use the service role key in browser code. Do not print any keys.
5. Tell me the SQL you added and how I can confirm it in the Supabase SQL editor.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes