DEV Community

Cenk KURTOĞLU
Cenk KURTOĞLU

Posted on

Supabase RLS breaking change (Oct 30, 2026): 5-minute check to avoid 42501 errors

#supabase #postgres #security #webdev

Oct 30, 2026, Supabase is enforcing a breaking change for RLS grants in the public schema. Existing tables are unaffected; new tables created after that date will stop being exposed to the Data API unless you explicitly grant access.

What's changing?

After October 30, 2026, newly created tables in public will no longer be automatically exposed via the Data API/GraphQL. Any code that assumes INSERT/SELECT/UPDATE/DELETE work for anonymous/authenticated roles on new tables will start returning 42501: permission denied.

Good news: existing tables keep their current grants and remain reachable. This only affects tables created from October 30 onward.

5-minute check

The fastest way: check your current grants in the SQL Editor (read-only).

select grantee, table_name, privilege_type
from information_schema.role_table_grants
where table_schema = 'public'
and grantee in ('anon', 'authenticated');
Enter fullscreen mode Exit fullscreen mode

If this looks correct for the tables your client code touches, you're fine. If your migrations will create new tables going forward, you need explicit GRANT statements or ALTER DEFAULT PRIVILEGES.

Fix for new tables (migrations)

Add explicit grants in your migrations, e.g.:

grant select, insert, update, delete on table public.my_new_table to anon, authenticated;
Enter fullscreen mode Exit fullscreen mode

Or set defaults for roles:

alter default privileges in schema public
grant select, insert, update, delete on tables to anon, authenticated;
alter default privileges in schema public
grant usage, select, update on sequences to anon, authenticated;
Enter fullscreen mode Exit fullscreen mode

Verify before Oct 30

  1. Open your Supabase project → Security Advisor. It flags tables affected by this change.
  2. Review migrations that run after Oct 30: ensure they GRANT to anon/authenticated or set ALTER DEFAULT PRIVILEGES.
  3. Test on a preview branch: create a temporary table via migration and hit Data API from anon/auth contexts.

Learn more

Free checklist + kit

Fixing RLS before enforcement is cheap. Grab the 10-point Supabase RLS pre-launch checklist (free):

Free Supabase RLS 10-checks checklist →

Need to harden an existing app (policies, USING vs WITH CHECK, multi-tenant leaks)? The RLS Audit Kit ($29) packages the checklist + SQL smoke tests + policy review prompts:

RLS Audit Kit ($29) →

Top comments (0)