Supabase: RLS disabled in public (0013_rls_disabled_in_public)

Updated 2026-10-10

Supabase's security advisor reports it as lint 0013_rls_disabled_in_public.

What it means. Your app talks to Supabase with the anon key, and that key ships inside every copy of the app. Anyone can extract it and call the REST API directly. For a table in the public schema without row level security, that means reading and changing every row.

How to fix it. Enable RLS and add a policy for the access each table needs, in a migration:

alter table public.todos enable row level security;

create policy "Users read their own todos"
  on public.todos for select
  using (auth.uid() = user_id);

With RLS on and no policy, nobody can read the table through the API, so add policies for what the app does.

A detail we see in real apps. The enable row level security line written but commented out. In our scan, 3 of 15 apps with Supabase migrations had at least one public table without RLS, one of them a starter template with payment and invoice log tables.

Check your repository. npx nativekeel reads the migrations under supabase/ and lists public tables that never enable RLS. Also check the dashboard (Table Editor) for tables created there.

Check your whole app in one command: npx nativekeel
Free, runs locally (your code is not uploaded), no account. It reports this and 80 other upgrade, store, crash and security problems.

Supabase: RLS disabled in public (0013_rls_disabled_in_public)

Sources