IDOR: reading or changing someone else's data in Supabase

criticalUpdated Oct 12, 2026

Fix for Supabase

create policy "notes_select_own"
on public.notes
for select
to authenticated
using (auth.uid() = user_id);

Repeat for insert (with check), update, and delete. Enable RLS or the policy is stored and not enforced. Supabase's linter calls that out as policies existing while RLS is disabled.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.