row-level security
Database policies control which rows a role may access.
Use this when Users or tenants share tables but must not access each other’s rows.
without the term
“We use Supabase and I'm scared one user could read another user's data by calling the API directly. Can you lock it down at the database level so people only see their own rows?”
with the term · How do you ask a model for row-level security?
Add row-level security for these tenant records. Test reads and writes as the runtime role, proving tenant B cannot access tenant A’s rows.
What is row-level security?
Postgres RLS applies policies to row access. Roles that bypass RLS require separate care.
Why does row-level security matter when vibe coding?
A missing application filter can otherwise expose another user’s records.
How do you do row-level security?
Define read and write policies using trusted identity. Check them as the actual runtime role with two users.
What goes wrong with row-level security?
Tests use an administrative role that bypasses the policies.