AskVibeMarked as helpful by the asker
By default a Postgres view runs with the permissions of its owner, and in Supabase that's postgres, which bypasses RLS. So your view reads the tables as a superuser.
On Postgres 15+ (all current Supabase projects) you can make it respect the caller's RLS:
alter view public.posts_with_author set (security_invoker = true);Better, create it that way in the migration, and repeat the with part whenever you recreate it:
create or replace view public.posts_with_author
with (security_invoker = true) as
select p.*, pr.display_name
from posts p join profiles pr on pr.id = p.author_id;The Security Advisor flags these as security_definer_view. Worth checking for others.
Fixed and the advisor found a second one I forgot about. Scary. ngozi_c · edited
Remember profiles now also needs a select policy for anon, or the join will drop every row for logged-out visitors. hannah_reyes · edited