Landing page with a waitlist form. No accounts. I want the form to insert into a waitlist table. Right now it fails with the RLS error. What's the right policy? I don't want strangers reading the list of emails.
Tried create policy ... for all using (true) which works but then I can also select everything with the anon key, which is exactly what I don't want.
Insert-only policy for the anon role, no select policy at all:
AskVibecreate policy "anyone can join waitlist" on public.waitlist
for insert to anon
with check (true);With RLS on and no select policy, reads return an empty array. One gotcha: don't chain .select() after the insert in your client code, because returning the row needs select permission and you'll get the RLS error again.
Sanne's policy is right. The part people skip: with the anon key public, anyone can script 50,000 inserts into that table. Add a check constraint on the email length and format, and consider sending the form through a server action or edge function with a captcha (Turnstile is free) instead of inserting directly from the browser.
I did the server action route for my waitlist, using the anon key server side with the same insert policy. Keeps the table out of the browser entirely and you can rate limit per IP there.