Supabase
Security & compliance
Service-role client queries a table with no tenant filter
Part of the Auth & service-role key safety check · fix arrives as a pull request
What it is
A query made with the service-role client has no filter scoping it to a user or tenant.
Why it matters
The service-role client ignores RLS, so the tenant filter RLS would have applied does not exist. The query returns or modifies every row for every customer, and it does so without error.
How to fix it
Add the tenant predicate explicitly — .eq('user_id', user.id) — or use a user-scoped client so RLS applies the filter for you. Reserve the service-role client for genuinely cross-tenant work.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.