Understanding security on views and manually created tables

In this book, when creating tables, we used the Supabase Studio UI. Then, for those tables, we were able to create RLS policies. When no RLS policies are added, a table is safe, as it will prevent access to everyone but admins. However, some people assume that when creating a table with raw SQL, the same thing is true. That is not the case.

Here’s an example of creating a todos table SQL:

CREATE TABLE todos (
  id SERIAL NOT NULL PRIMARY KEY,
  content TEXT,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  completed_at TIMESTAMPTZ
);

Executing this will show the table in the Table Editor with an open lock icon, as well as state that RLS is disabled in the Table Editor view of Supabase Studio.

Figure 12.9: An unsafe table

To some, this might be obvious, but for many, it isn’...