AskVibeMarked as helpful by the asker
Supabase does not separate users automatically, RLS does, and it is off by default on new tables. A frontend filter is decoration; the database must refuse.
alter table projects enable row level security;
create policy "own projects" on projects
for all using (auth.uid() = owner_id) with check (auth.uid() = owner_id);Then test it the way you already did: remove the filter in the network tab. You should get an empty list. Do this for every table with user data, and assume the same bug exists in every other table Lovable created.
RLS was off on all four tables. Turned it on and now I see nothing at all, not even my own projects. noor_builds · edited
Expected until you add the policy. RLS with no policy denies everything. Run the create policy statement as well. mira_dev · edited
Done, both accounts only see their own now. Thank you so much. noor_builds · edited
Keep the
with check part. Without it a user can still update a row so it belongs to someone else. hannah_reyes · editedFound this through search, exact same problem in my Lovable app. Fixed in ten minutes. mina_j · edited