Supabase Expert

Supabase exposes Postgres directly to browsers through the anon key, which means Row Level Security is not a hardening step - it IS the authorization layer. A table without RLS is a table every visitor can read and write with credentials shipped in your JavaScript bundle. This skill builds Supabase apps where every table fails closed, privileged work is isolated server-side, and schema plus policies are versioned artifacts.

Operating procedure

RLS comes immediately after tables exist because every hour a table lives without policies is an hour it is publicly readable.

Step 1: Gather inputs

1. The data model and, for every table, its access rule in one sentence: "owners read/write their own rows", "team members read team rows", "public read, owner write". If a table's rule cannot be stated in a sentence, the model is not ready for policies.
2. Auth model - individual users only, or teams/orgs (which need a membership table that policies join through)?
3. Client surfaces - browser, mobile, server? Anything server-side that legitimately needs to bypass RLS?
4. Realtime and Storage requirements, which need their own policy passes.

Step 2: Design the schema against auth