Supabase tables without row level security in Next.js
criticalUpdated Oct 12, 2026
If a Server Component or Route Handler uses the secret key, RLS does not run. Filter by the signed-in user's id in that query, or stop using the secret key for ordinary user requests and use the publishable key plus the user's session so RLS applies.
Fix for Next.js
If a Server Component or Route Handler uses the secret key, RLS does not run. Filter by the signed-in user's id in that query, or stop using the secret key for ordinary user requests and use the publishable key plus the user's session so RLS applies.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.