# Supabase RLS audit: supabase/migrations

1 migration files, 3 tables, 2 with RLS on.
High: 2 | Medium: 1 | Low: 0 | Info: 0

## Tables

| Table | RLS | Policies |
| --- | --- | --- |
| public.payments | **OFF** | 0 |
| public.posts | on | 1 |
| public.todos | on | 1 |

## High

- **public.payments** (rls-disabled, 0001_init.sql): Row level security is off. Anyone with your public anon key can read and change every row through the API.
  - Fix: `alter table public.payments enable row level security;`
- **public.todos / todos any user** (policy-any-user-write, 0001_init.sql): FOR ALL only checks that someone is signed in, so any user can read and change other users' rows.
  - Fix: Compare the row's owner column with (select auth.uid()) instead.

## Medium

- **public.posts / public posts** (policy-public-read, 0001_init.sql): USING (true) for anon or public: the whole table is readable by anyone on the internet. Fine for truly public data (blog posts, pricing), a leak for anything else.
  - Fix: If it is not meant to be public, restrict to authenticated and scope to the owner.