USING (true) RLS leaked the whole users table

Tried

Ship Supabase-backed MVP with Cursor / Lovable / v0 so the demo stops throwing permission errors

Broke

Policies like Enable read access FOR SELECT USING (true) left emails and profiles dumpable via the anon key

Fix

Separate security pass: owner policies with auth.uid(); grep migrations for using (true); test as two users

Original source · ← All stories