What is Query?

A question your app asks the database, such as 'give me all orders for this customer'.

Where Query goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Launch day · 4 minutes · Pro
Fast with 50 rows, slow with 20 million
Your orders page was instant in testing. Two years and 20 million orders later, it takes eight seconds to load.
Why did my database get slow as it grew?
Usually because queries filter or sort on columns without an index, so the database reads every row. With little data this is instant; with hundreds of thousands of rows it is slow. Add indexes on the columns you filter and sort by, especially foreign keys, and test with realistic data.
Read the fix
Teams and sharing · 4 minutes · Pro
The export with everyone's data
A customer clicked 'Export orders to CSV'. The file had 40,000 rows. Their team has 300 orders. The rest belong to your other customers.
Does the Supabase service role bypass RLS?
Yes. The service role key bypasses every row level security policy by design, so any server code using it must check permissions itself. Leaks happen when that code also takes the team or user id from the URL or request body. Query with the signed-in user's client so RLS applies, and derive the team from their session.
Read the fix
Who may see what · 4 minutes · Free
Invoice 105
Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
What is an IDOR vulnerability?
An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.
Walk it, free
Who may see what · 5 minutes · Pro
The table anyone can read
Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
Why can anyone read my Supabase table?
Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().
Read the fix
Data you can lose · 4 minutes · Pro
Exactly 1,000 orders
Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.
Why does my Supabase query return only 1000 rows?
Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.
Read the fix
AI inside your app · 4 minutes · Pro
Another customer's document
Your 'chat with your documents' app answered a question by quoting a contract. The user has never uploaded a contract. Another customer has.
How do I keep RAG data separate per user?
Filter by user or team inside the search itself, before results reach the model. Similarity search returns the closest chunks from everything it can see, so an unfiltered query mixes customers. In Supabase, avoid security definer match functions that skip RLS, use security invoker, filter by owner, and test with two accounts.
Read the fix

Table, row, column: A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Supabase: A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

All 62 terms in the glossary

Where Query goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Launch day · 4 minutes · Pro

Fast with 50 rows, slow with 20 million

Your orders page was instant in testing. Two years and 20 million orders later, it takes eight seconds to load.

Why did my database get slow as it grew?

Usually because queries filter or sort on columns without an index, so the database reads every row. With little data this is instant; with hundreds of thousands of rows it is slow. Add indexes on the columns you filter and sort by, especially foreign keys, and test with realistic data.

Read the fix

Teams and sharing · 4 minutes · Pro

The export with everyone's data

A customer clicked 'Export orders to CSV'. The file had 40,000 rows. Their team has 300 orders. The rest belong to your other customers.

Does the Supabase service role bypass RLS?

Yes. The service role key bypasses every row level security policy by design, so any server code using it must check permissions itself. Leaks happen when that code also takes the team or user id from the URL or request body. Query with the signed-in user's client so RLS applies, and derive the team from their session.

Read the fix

Who may see what · 4 minutes · Free

Invoice 105

Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.

What is an IDOR vulnerability?

An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.

Walk it, free

Who may see what · 5 minutes · Pro

The table anyone can read

Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.

Why can anyone read my Supabase table?

Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().

Read the fix

Data you can lose · 4 minutes · Pro

Exactly 1,000 orders

Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.

Why does my Supabase query return only 1000 rows?

Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.

Read the fix

AI inside your app · 4 minutes · Pro

Another customer's document

Your 'chat with your documents' app answered a question by quoting a contract. The user has never uploaded a contract. Another customer has.

How do I keep RAG data separate per user?

Filter by user or team inside the search itself, before results reach the model. Similarity search returns the closest chunks from everything it can see, so an unfiltered query mixes customers. In Supabase, avoid security definer match functions that skip RLS, use security invoker, filter by owner, and test with two accounts.

Read the fix

Related terms

Table, row, column

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Supabase

A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.