The export with everyone's data
A customer clicked 'Export orders to CSV'. The file had 40,000 rows. Their team has 300 orders. The rest belong to your other customers.
This answers: Does the Supabase service role bypass RLS? No coding needed. 3 quick decisions.
- Who may see what
- Keys and secrets
- Where your data lives
Checking your access…
Does the Supabase service role bypass RLS?
Yes. The service role key bypasses every policy by design, so any server code using it must check permissions itself. Leaks happen when that code also takes the team or user id from the URL or request body. Query with the signed-in user's client so RLS applies, and derive the team from their session.
Breaks at Your server: Service role key, team taken from the URL
Why AI tools write this bug
When a query fails because of , AI tools often switch to the service role key, which makes the error disappear along with the protection.
How to fix it
- Find every use of the service role key.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Is the service role key ever okay to use?
- Yes, for trusted server jobs like webhooks or admin tasks. Keep it out of the browser and never let a caller choose whose data it touches.