What does Supabase's Security Advisor not flag?

The Security Advisor in Supabase is free and worth running. It lints your schema and settings, and it will flag a table with RLS turned off.

One thing it skips by design: a read policy like using (true). That's often a real public catalog, so the Advisor can't know if you meant it. But if that table holds users or orders, anyone with your public key can read every row.

So a clean Advisor result means your schema passed its lints, not that signed-out visitors can't read anything.

What do you check before real users arrive? If you'd like your database looked over, our Database Check ($49, one time) is a read-only review of Row Level Security and policies, anon and authenticated grants and storage buckets: https://patchandship.com/pricing?utm_source=devto&utm_medium=community&utm_campaign=new-offers