Your AI-built app has RLS disabled. Here's how to tell in 30 seconds.
The single most common production-breaking bug in vibe-coded Supabase apps — and the one-line check that exposes it.
Open your project's Data API URL in an incognito window with any authenticated user's token. Run `select * from public.users`. If you get rows back that aren't yours, your row-level security is off — or your policy is wrong.
We've audited 47 vibe-coded apps. 41 of them had at least one table with RLS disabled. The AI builder happily generates the table and policy SQL, but if you ever ran a "fix this for me" prompt that touched migrations, there's a 60% chance it dropped the policy along the way.
The fix is two lines per table — but "two lines per table" assumes you know which tables, which roles, and which policies. Most founders don't, and that's fine. Send us the project; we'll mark every miss for free.