Row-Level Security

ELI5 — The Vibe Check

Row-level security (RLS) is like having an invisible bouncer on every table row. Even if someone has access to the table, they can only see and modify rows they're allowed to touch. Supabase uses this heavily so your users can only see their own data, even though everyone shares the same database.

Real Talk

Row-Level Security (RLS) is a PostgreSQL feature that allows fine-grained access control at the row level through security policies. Policies are SQL expressions evaluated for each row during SELECT, INSERT, UPDATE, or DELETE operations. RLS is fundamental to multi-tenant architectures and platforms like Supabase that expose the database directly to clients.

Show Me The Code

ALTER TABLE posts ENABLE ROW LEVEL SECURITY;

CREATE POLICY user_own_posts ON posts
  FOR ALL
  USING (user_id = current_setting('app.current_user_id')::int)
  WITH CHECK (user_id = current_setting('app.current_user_id')::int);

When You'll Hear This

"RLS ensures tenants can never see each other's data, even with direct DB access." / "Supabase's entire security model is built on Postgres RLS."