PatchVault › Errors › Vibe-coded app security

new row violates row-level security policy for table

Postgres error 42501: RLS is enabled on the table and the row you inserted or updated fails the policy's WITH CHECK condition, or no INSERT policy exists.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py) .

Why it happens

Common causes: no INSERT policy for the authenticated role, user_id not matching auth.uid(), or no SELECT policy when the client asks for the inserted row back. Disabling RLS is not a fix.

Manual fix

create policy "insert own rows" on public.todos
  for insert to authenticated with check (auth.uid() = user_id);
create policy "read own rows" on public.todos
  for select to authenticated using (auth.uid() = user_id);
alter table public.todos alter column user_id set default auth.uid();

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• Supabase: Row Level Security

Related errors

• GH013: Push cannot contain secrets: fix
• Supabase rls_disabled_in_public: table publicly accessible

Full guide and free terminal scanner: Vibe-coded app security fix bundle. Last checked 2026-10-31.