What is Table, row, column?

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Where Table, row, column goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 4 minutes · Pro
Permission denied for table
Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.
Why does Supabase say permission denied for table?
The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.
Read the fix
Who may see what · 5 minutes · Pro
The table anyone can read
Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
Why can anyone read my Supabase table?
Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().
Read the fix
Launch day · 4 minutes · Pro
Fast with 50 rows, slow with 20 million
Your orders page was instant in testing. Two years and 20 million orders later, it takes eight seconds to load.
Why did my database get slow as it grew?
Usually because queries filter or sort on columns without an index, so the database reads every row. With little data this is instant; with hundreds of thousands of rows it is slow. Add indexes on the columns you filter and sort by, especially foreign keys, and test with realistic data.
Read the fix
Who may see what · 4 minutes · Pro
One field, a million credits
A free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.
How do users give themselves a paid plan?
If users may update their own row and that row also stores plan, credits or role, they can send those fields in a normal request. Keep anything that grants access or money in a table users can only read, change it from the server, and grant paid plans only from a verified payment event.
Read the fix
Data you can lose · 4 minutes · Pro
Exactly 1,000 orders
Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.
Why does my Supabase query return only 1000 rows?
Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.
Read the fix
Data you can lose · 4 minutes · Pro
Back to yesterday's version
Today's update broke checkout, so you restore yesterday's version in your builder. Now the whole app crashes.
Why does rolling back my app break it?
Rolling back restores your code, not your database. If today's migration renamed or dropped a column, yesterday's code still expects the old shape and crashes. Make schema changes additive: add the new column, switch the code, and remove the old one only when nothing uses it.
Read the fix

Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Supabase: A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.

All 62 terms in the glossary

Where Table, row, column goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 4 minutes · Pro

Permission denied for table

Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.

Why does Supabase say permission denied for table?

The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.

Read the fix

Who may see what · 5 minutes · Pro

The table anyone can read

Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.

Why can anyone read my Supabase table?

Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().

Read the fix

Launch day · 4 minutes · Pro

Fast with 50 rows, slow with 20 million

Your orders page was instant in testing. Two years and 20 million orders later, it takes eight seconds to load.

Why did my database get slow as it grew?

Usually because queries filter or sort on columns without an index, so the database reads every row. With little data this is instant; with hundreds of thousands of rows it is slow. Add indexes on the columns you filter and sort by, especially foreign keys, and test with realistic data.

Read the fix

Who may see what · 4 minutes · Pro

One field, a million credits

A free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.

How do users give themselves a paid plan?

If users may update their own row and that row also stores plan, credits or role, they can send those fields in a normal request. Keep anything that grants access or money in a table users can only read, change it from the server, and grant paid plans only from a verified payment event.

Read the fix

Data you can lose · 4 minutes · Pro

Exactly 1,000 orders

Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.

Why does my Supabase query return only 1000 rows?

Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.

Read the fix

Data you can lose · 4 minutes · Pro

Back to yesterday's version

Today's update broke checkout, so you restore yesterday's version in your builder. Now the whole app crashes.

Why does rolling back my app break it?

Rolling back restores your code, not your database. If today's migration renamed or dropped a column, yesterday's code still expects the old shape and crashes. Make schema changes additive: add the new column, switch the code, and remove the old one only when nothing uses it.

Read the fix

Related terms

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Supabase

A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.