PatchVault › Errors › Vibe-coded app security

rls_disabled_in_public: Table publicly accessible

Supabase's Security Advisor (lint 0013) flags a table in an API-exposed schema (usually public) with Row Level Security disabled.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py) .

Why it happens

Without RLS, anyone who has your project URL and the public anon key (it ships in your frontend bundle) can read and write that table through the API.

Manual fix

alter table public.profiles enable row level security;
create policy "own profile" on public.profiles
  for all to authenticated using (auth.uid() = id) with check (auth.uid() = id);

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• Supabase: Database Advisors
• Supabase: Row Level Security

Related errors

• GH013: Push cannot contain secrets: fix
• Supabase "new row violates row-level security policy"

Full guide and free terminal scanner: Vibe-coded app security fix bundle. Last checked 2026-10-31.