Three ways a Supabase schema passes review and still leaks (free fixture + the kit I sell)

[cekuu35]

I keep running into the same thing when I look at Supabase schemas: RLS is switched on, the dashboard is green, and the data boundary still is not where the team thinks it is. Not because the SQL is wrong — because the SQL is valid and says something slightly different from what was intended.

The three that come up most:

A policy exists but RLS was never enabled on the table. The policy rows sit in pg_policies, so everything reads as configured, and Postgres enforces none of it. This is more common than it sounds — I found a public repo today where policies were defined on about twelve tables and RLS was enabled on three.

A permissive policy quietly cancelling a restrictive one. Permissive policies combine with OR, so a broad leftover widens a careful one and each reads fine in isolation.

A membership join that is not isolated. A user who belongs to two organisations satisfies the USING clause for both. Every test written from a single-membership account stays green; the leak appears when the second real customer arrives.

Supabase's own linter catches the easy cases — RLS off, RLS on with no policy — and you should run it first, for free, before anything else. What it cannot evaluate is whether a policy that exists is correct.

The free part. A reproducible fixture for the third case, MIT licensed. Same test suite, red on one branch and green on the other, in about two seconds — no Docker, no cloud project, no credentials, because it runs Postgres in PGlite:

https://github.com/cekuu35/supabase-rls-leak-demo

npm ci && npm run test:ci

There is also a free PDF of the ten checks I run before shipping, no email wall: https://cengokurtoglu.gumroad.com/l/nextjs-supabase-10-checks-free

The paid part, so I am not being coy about it: I sell a $29 kit that packages the same audit as seven commented SQL files you run against your own catalogs — RLS coverage, policy conflicts, write-side WITH CHECK gaps, grants, bypass paths, Storage, Realtime, and a role-simulation harness that wraps its probes in BEGIN … ROLLBACK. Plus a 60-check workflow and report templates. It is for projects you own or are authorised to test, and it is a configuration review, not a penetration test.

https://cengokurtoglu.gumroad.com/l/supabase-rls-audit-kit

Happy to answer RLS questions in this thread either way — the fixture and the checklist are free and stay free, and if the linter plus that query is all you needed, you are done and you have spent nothing.

If anyone wants a specific policy shape reviewed, paste it here and I will take a look.