Supabase data access and isolation
Who Can Access Your App's Data?
Check the actual access paths, not just what the interface shows.
Your app stores customer records in Supabase. Before relying on an access rule, test what a signed-out visitor, each customer, and privileged server code can actually read or change.
Your app stores customer records in Supabase. Before relying on an access rule, test what a signed-out visitor, each customer, and privileged server code can actually read or change.
A login screen identifies a user. It does not by itself decide which rows that user may access.
Check the actual access paths, not just what the interface shows.
Supabase uses database privileges and Row Level Security policies to help control operations on data. Your application's server routes, functions, storage and privileged credentials also need attention.
Gridfused can help assess the access boundaries that matter to the product and prioritize corrections supported by evidence.
Technical audit for founders whose applications handle customer or business data.
Follow one record
Can One Customer Reach Another Customer's Report?
Imagine two customers each have a report in the same table. The dashboard shows only the signed-in customer's report, but the important question is what happens when that account requests a different report directly.
In an isolated test environment, create two test accounts and records with known owners. Check reading and permitted changes for each account, then repeat the checks without signing in. Include the server routes that act on those records.
The result is a small access matrix: what should be allowed, what should be denied, and which path produced the result.
Signs to investigate
Where Can an Access Review Start?
The UI hides another customer's records.
Check whether the underlying request also enforces that boundary.
A table is exposed to the application.
Review the roles with table privileges and the policies that apply to each operation.
A server function uses elevated access.
Privileged access may bypass RLS. The function still needs to decide whether the caller can perform the requested action.
Files or views expose the same data.
Storage, views and other routes can have their own access behavior and need separate checks.
A policy was added but never tested.
Test both the access you expect to allow and the attempts you expect to deny.
Choose the next step
What Should Happen After an Access Check?
The response depends on what the test shows and how the product is intended to share data.
1. Confirm a boundary and retain evidence
If allowed and denied cases behave as intended, document the tested roles, records and operations.
2. Correct a specific access path
If a grant, policy or server route does not match the intended behavior, isolate the affected operation before changing it.
3. Expand the review where needed
A shared-data model, privileged functions or connected storage may require a broader assessment.
How to decide
Compare the observed access with the product's intended permissions.
1. Confirm a boundary and retain evidence
Keep representative tests so a later policy or application change can be checked against the same expectations.
2. Correct a specific access path
Retest both the legitimate workflow and the denied cross-customer case after an agreed correction.
3. Expand the review where needed
Define scope and safe testing arrangements before examining additional systems or live customer data.
Prioritize the paths that expose or change the most consequential records, then verify the correction.
A practical access map
What Should a Supabase Access Review Cover?
Start with one important record and follow every route through which it can be read or changed.
1. Roles and Table Privileges
Understand which database roles can perform each operation.
How the work unfolds
How Gridfused Reviews Data Access
Step 1 — Define the Records and Users
We identify the data, customer roles and operations the business needs to protect.
Step 2 — Map the Access Paths
We trace requests through the interface, database policies, server functions and relevant connected services.
Step 3 — Test the Agreed Boundaries
Using an authorized scope and test data, we compare observed access with the intended rules and record the evidence.
Step 4 — Prioritize Findings and Next Steps
We explain the affected path, the business consequence and the proposed correction. Implementation can be scoped separately.
A defined engagement
What Can You Expect From the Review?
Assessment
A scoped review may include:
- An inventory of the records and access paths examined.
- A role and operation matrix with expected and observed results.
- Findings supported by the tests performed.
- Prioritized recommendations and remaining uncertainties.
Follow-up work
An agreed implementation may include:
- Changes to grants, policies or protected server paths.
- Repeatable access tests using representative test accounts.
- Verification of the agreed corrections.
- Documentation and a handover for the people operating the app.
Understand the boundary
How Do Supabase Policies Fit With Your App?
A database policy protects a particular path to data. The complete product may have several.
Map the caller and the credential used for each operation before deciding where a rule must be enforced.
Review these paths:
Client requests
Review grants and RLS policies for the role and user making the request.
Server functions
Check whether the server uses elevated access and independently validates the caller's authority.
Files and integrations
Check how stored files, exports and connected services enforce the same customer boundary.
When to get help
When Is an Independent Access Review Useful?
Consider a focused assessment when:
Multiple customers store records in the same application.
Policies exist but their allowed and denied cases have not been checked.
The app uses server functions or administrative credentials to access data.
You are preparing to onboard customers with sensitive or important records.
A developer handover has left the access model unclear.
Before the review
Frequently Asked Questions
Have a question about your access model?
How do I check whether Supabase RLS is working?
Identify the table, operation and intended roles, then test allowed and denied cases using separate test accounts and known records. Check the relevant grants and policies as well as the result of the application's request.
Does signing in prevent a customer from seeing another customer's data?
Authentication identifies the caller. Authorization rules must still determine which rows and actions that caller may access.
Is enabling RLS enough on its own?
RLS is one control. Review the applicable grants and policies, and check other access paths such as server functions, views and storage where relevant.
Can a server credential bypass RLS?
Privileged credentials can bypass RLS in applicable Supabase configurations. Keep secret credentials away from browser code and verify that privileged server operations authorize the caller.
Should I test against real customer data?
Prefer an isolated environment with test accounts and non-sensitive records. Agree on the scope and any necessary access before testing.
Does a failed access test prove a breach occurred?
No. A test may show that a boundary is not behaving as intended. Establish what is exposed and investigate the available evidence before drawing conclusions about an incident.
Have a question about your access model?
Your next step
Know What Your Customers Can Access.
Start with the records and actions your application needs to protect.
A focused review can show where the intended boundary is enforced, where more evidence is needed, and what to address next.
Gridfused helps founders assess technical risk with a scope grounded in the application and its actual use.
A few sentences are enough to begin.
Tell us what your app stores and which customer access concerns you want to investigate.
Choose one important record and follow the request that reaches it.