RepoAssistant logoRepoAssistant
← All guides

RLS rescue guide

Supabase RLS blocks your app queries in production

SupabaseVPS

Short answer

Correct RLS policies that protect data while allowing your app to function, with service role keys properly secured.

Why this matters

Your app reads and writes data locally, but in production every query returns permission denied because RLS policies are too restrictive or missing.

Walkthrough

  1. 01

    Find the failing queries

    Check your app logs and Supabase dashboard to identify which tables and queries are blocked.

    • Look for 403 or permission denied errors in app logs.
    • Check the Supabase SQL editor for policy evaluation details.
    • Identify which roles (anon, authenticated, service_role) the queries run under.
  2. 02

    Fix the RLS policies

    Write policies that allow legitimate app access while keeping data protected.

    • Add SELECT policies for tables the app needs to read.
    • Add INSERT and UPDATE policies with user ownership checks.
    • Test policies in the Supabase SQL editor before deploying.
  3. 03

    Secure service role keys

    Service role keys bypass RLS. They must never reach the browser.

    • Confirm service_role keys are only used server-side.
    • Rotate any service role key that was exposed in client code.
    • Use anon key for browser requests and authenticated role for user actions.

Where RepoAssistant fits

RepoAssistant diagnoses and fixes Supabase RLS errors during production deploy so your app can read and write data correctly.