v0.12.0 - Rows

The "Rows" release. In a Supabase app the browser holds the anon key and queries the database directly, so row level security, not your API routes, decides who can read and write a table. CodeDiag now checks it in your migrations.

npx @sabahattink/codediag scan .

Highlights

• Tables without RLS are critical. CodeDiag replays supabase/migrations in order: renames, schema moves, drops, disable row level security, and revoke all from anon and authenticated. Any table that ends up in an exposed schema without RLS is reported at its create table line. Exposed schemas are public by default, or the ones in supabase/config.toml.
• Policies open to every row. CodeDiag flags update, delete, or all policies whose using is true, and anon insert policies whose with check is true. Public read policies are left alone.
• SQL-aware. Comments, strings, and function bodies never count. A table that is public on purpose can be suppressed with a -- codediag-ignore-next-line comment and a reason.
• What a clean scan does not mean is now spelled out in the README: object-level authorization, policy conditions, Server Actions, and more.

Checked against vercel/nextjs-subscription-payments, Basejump, and chatgpt-your-files. Suggested by a reader on Indie Hackers. See the changelog.