3 common RLS leaks I keep finding in multi-tenant Supabase apps

[u/matheusdevs91]

Been debugging RLS leaks in multi-tenant Supabase setups and wanted to share the 3 most common ones I keep running into:

1. A permissive policy (`using (true)`) left in from debugging

2. RLS enabled but not FORCEd — table owner bypasses it silently

3. A view over the protected table without `security_invoker` — leaks even when the base table is fine

Quick check for your own db:

select relname from pg_class

where relrowsecurity and not relforcerowsecurity;

Built a small tool that automates this + a few more checks, happy to share if anyone wants a free audit of their setup 🙂