Enabling Supabase RLS alone doesn't keep data private; seven other surfaces can leak it

A developer explains that turning on Row Level Security in Supabase does not by itself make data private, since policies, views, grants, and related objects also determine access. The article warns that a common mistake is shipping a broad "temporary" policy, such as one using a true condition, which leaves tables readable by anyone holding the public anon key. It also notes that policies lacking WITH CHECK clauses can let users write rows into other tenants' data. Views running with owner privileges can bypass base-table RLS unless configured with security_invoker, and loose grants to anon or authenticated roles can expose sensitive tables. The author provides read-only catalog queries to audit these surfaces, beginning with the pg_policies view.