Supabase RLS Policy Flaw Can Expose Entire Users Table to Anonymous Requests

A subtle but critical misconfiguration in Supabase Row-Level Security (RLS) policies can inadvertently expose all user profile data to unauthenticated requests. Because PostgreSQL evaluates null comparisons and boolean logic in a way that makes an unguarded policy resolve to true for anonymous callers, the anon key — which is intentionally public and ships in client bundles — can bypass intended access controls. A developer discovered this in a real app where profile data including names, timezones, and availability schedules was fully accessible via a simple curl request, despite the app redirecting signed-out users to a login page in the browser. The fix involved adding an explicit auth.uid() is not null guard to the RLS policy, ensuring anonymous sessions are blocked at the database level rather than relying on client-side redirects. For cases where anonymous users need aggregate data, the recommended approach is a security definer function that returns only computed numbers, keeping raw rows inaccessible to unauthenticated callers.