priya_ships Marked as helpful by the asker
Supabase does not separate users automatically, RLS does, and it is off by default on new tables. A frontend filter is decoration; the database must refuse.
alter table projects enable row level security;
create policy "own projects" on projects
for all using (auth.uid() = owner_id) with check (auth.uid() = owner_id);Then test it the way you already did: remove the filter in the network tab. You should get an empty list. Do this for every table with user data, and assume the same bug exists in every other table Lovable created.
RLS was off on all four tables. Turned it on and now I see nothing at all, not even my own projects. 
noor_builds
noor_builds Expected until you add the policy. RLS with no policy denies everything. Run the create policy statement as well. mira_dev
Done, both accounts only see their own now. Thank you so much. noor_builds
noor_builds Keep the 
hannah_reyes
with check part. Without it a user can still update a row so it belongs to someone else. hannah_reyes Found this through search, exact same problem in my Lovable app. Fixed in ten minutes. 
mina_j
mina_j 