>_ access rules
Build the access rules for a Supabase table
Pick who may read, add, change and delete the rows in one table. You get the SQL to paste into the Supabase SQL editor, and what each rule does in plain words.
Everything happens in this browser. Nothing you type is sent or saved.
As it appears in the Supabase table editor, for example notes. Another schema: private.notes.
Usually user_id: a uuid column that stores the id of the user who created the row.
Start from
Anyone on the internet, without signing in, could change your data with these rules. Pick this only if that is really what you want.
What these rules do
Then check it worked
- Open the SQL editor in your Supabase project, paste the rules and run them.
- Repeat for every table that holds user data.
- Run the anon key check from our fix and confirm a stranger gets nothing back.
Your Supabase app might be wide open: the fix Supabase guide to row level security
This version covers data owned by one user. Rules for data a team shares need a membership table and are not covered here yet.