Tagged RLS
4 articles
Supabase Security Definer Functions: The Exposure You Might Miss
In Supabase, public-schema functions are callable over the API — and SECURITY DEFINER ones bypass row-level security. What our audit found in 117 such functions, the real damage paths, and the grants and rules that close them.
Supabase Row-Level Security for Multi-Tenant Apps: A Guide
A production pattern for multi-tenant isolation in Supabase — one organization_id column, security-definer helpers, policies that combine tenant and role, triggers that fill the tenant, and tests that prove it.
Role-Based Access for Internal Tools: A Practical Design
How to design role-based access for an internal tool — a few flat roles, additive grants for special cases, enforcement in the database, and UI that mirrors it — without ending up with a permissions spreadsheet nobody understands.
Row-Level Security vs App-Layer Authorization: Which Wins?
App-layer checks have to be remembered on every route; row-level security is enforced on every query. When each is right, how to combine them, and the performance and testing details that make RLS work in production.