security//RLS

Row Level Security is a lock at the database level: every row has an owner (`user_id`), and RLS ensures that only that owner can see it. Even if the code has a bug that requests all contacts without filtering, the database returns Carmen only her own.

Row Level Security is a lock at the database level: every row has an owner (user_id), and RLS ensures that only that owner can see it. Even if the code has a bug that requests all contacts without filtering, the database returns Carmen only her own.

Without RLS, security depends entirely on the application code filtering correctly; with RLS, the database is the last line of defense.

Trusting that the door was locked, against a door that locks itself.

RLS is the second kind of door.

RLS is a second layer of security. Even if the first one fails (a backend bug, a badly protected endpoint), the database holds: malicious code can push, but the database will not release another user's data.

In Supabase it is enabled per table, and each table has policies like SELECT only if auth.uid() = user_id. Supabase connects this to its OAuth system: the session token identifies the user, and RLS filters automatically. OAuth answers who are you, RLS answers what can you touch.