Developer shares SQL impersonation method to verify Supabase Row Level Security in SaaS apps

A developer building a multi-tenant SaaS starter kit using Next.js, Supabase, and Stripe wanted to verify that Row Level Security (RLS) policies actually prevented one user from accessing another's data. Rather than assuming the Postgres-based policies were correct, they ran impersonation tests directly in the SQL editor by temporarily assuming a user's identity within a rolled-back transaction. The test confirmed that RLS silently filters out unauthorised rows — returning zero results instead of an error — which is the expected success signal. The same approach was applied to write operations, ensuring that delete attempts on another user's rows returned zero rows affected. The developer notes the test takes about two minutes and is particularly valuable for catching privacy failures before they reach production.