Topic
A database security feature restricting which rows a query can access via policies, used for per-tenant isolation in Postgres platforms like Supabase.
Supabase will stop exposing new public-schema tables to its Data API automatically on all existing projects on 30 October 2026. Tables created after that date stay invisible to supabase-js until a role is granted access.
Reality
UpGuard found 16,326 Supabase databases with readable tables in a scan of roughly 300,000 domains. Supabase's new default keeps new tables off its APIs, but older tables keep their grants until owners review them and their row-level security.
Reality
Ninety-eight of 100 public Supabase migration histories leave a table the Data API cannot reach once automatic grants end on Oct 30, a dev.to replay found. Existing tables keep their grants, so the failures land on new tables and on environments rebuilt from those files.
Reality
Amazon Quick's AI-built apps now query governed Quick Sight datasets, in SPICE or Direct Query mode, each time someone opens them. Queries run under the viewer's identity, so the row- and column-level rules already on a dataset decide what each person sees.
Reality
One developer moving a 99-table SaaS off Supabase Cloud saw all 228 row-level security policies fail silently until auth.uid() moved with the database. Any app that queries Postgres from the browser has to bring its auth and session layers across in the same cutover.
Reality
Matt Palmer's scan found 170 of 1,645 Lovable showcase apps leaking data through inadequate Row Level Security, the same kind of gap Wiz found at Moltbook. Before launch, an AI-built app needs a review that tests the database rules behind its public key.
Reality
UpGuard found more than 16,000 Supabase databases exposing readable tables of personal data, passwords and authentication tokens. It blames row-level security and key settings that each project's owner controls, so every app needs its own fix.
Reality
Row-level security in a no-backend Neon app refused 27 of 27 tenant attacks, yet a removed member read on for 928 seconds. A membership check in the policies closed that gap at a cost of about 5 ms on function calls.
Reality
Sanity blocks published writes by API default, Notion records Custom Agent runs in its Enterprise audit log, and Supabase tells developers to keep its MCP server off production. None of the three tests whether the value is right.
Reality
A dev.to walkthrough builds the whole retrieval path on pgvector and the azure_ai extension inside Azure Database for PostgreSQL. The costs land in the DDL, the extension allowlist, and a transaction that waits on an HTTP call.
Reality
A Row Level Security policy can pass Lovable's scanner, restrict itself to authenticated users, join a membership table, and still hand every order in the database to anyone who signs up. Two SQL queries find it.
Reality
A checklist written by someone who sells generated multi-tenant backends dates the tenant model and the source of tenant identity to day one, and the database isolation argument to the first paying customer. The author then runs the test on their own product.
Reality
A buyer's checklist published on dev.to puts accuracy measurement and permission enforcement ahead of the live demo, and every question on it comes with a test you can run inside the meeting. Its author sells in the category.
Reality
A developer's Aave liquidation monitor went silent five minutes into a free-tier Alchemy WebSocket. The getLogs loop written to replace it samples ten blocks on a fifteen-minute timer, so most blocks are never read.
Reality
A dev.to tutorial benchmarks naive multi-tenant Row-Level Security at roughly 575 times slower than no policy at all. The variable is function volatility, not schema or traffic.
Reality