Reading a database query
Your AI wrote the query for the 'My orders' page. Before launch, you want to be sure it loads this customer's orders, not everyone's.
This answers: How do I read a Supabase query? No coding needed. 3 quick decisions.
- Reading code
- Where your data lives
- Who may see what
Step 1 of 3
Read it top to bottom. What does it ask the database for?
const { data: orders } = await supabase .from("orders") .select("id, total, created_at") .eq("status", "paid") .order("created_at", { ascending: false }) .limit(20);How do I read a Supabase query?
Read it like a sentence: from this table, select these columns, for rows matching these filters, in this order, at most this many. Then ask whose rows it returns. Being signed in doesn't limit them; only a filter on the user and rules on the table keep each customer to their own rows.
Breaks at Database: No rule limits rows to their owner
Why AI tools write this bug
AI tools write queries that return the right data in testing, where you are the only user, without filtering by owner or turning on .
How to fix it
- Read each line: table, columns, filters, order, limit.
- Check the query filters by the signed-in user.
- Turn on for every table.
- Add a rule limiting rows to their owner.
Check your own app
Paste this into Lovable, Cursor or Claude Code:
Without changing anything, list every database query in this app. For each, explain in one plain sentence what it asks for, then tell me whether it filters by the signed-in user and whether Row Level Security is on for that table with a rule that limits rows to their owner.
Common questions
- What is a row and a column?
- A table is like a spreadsheet. Each row is one record, such as one order. Each column is one detail of every record, such as its total or status.