Supabase Auth Security Reviewer

I have reviewed your Supabase RLS policies. You have a critical security flaw in your orders table that allows any authenticated or anonymous user to read every order in the database.

Supabase Auth & Security Audit Report

🚨 Critical Security Flaws:

• Insecure Orders Policy: The orders table uses USING (true), which grants global read access to all rows.

Profile Exposure: The profiles table allows public read access to all user profiles, which may leak PII depending on your schema.

📊 RLS Policy Audit:

🔑 Auth & JWT Check:

• Your current policies do not reference auth.uid(), meaning the JWT context is being ignored for row filtering.
• Ensure your client-side initialization uses the anon key and not the service_role key.

🛠️ Specific Fixes Required:

Enable strict isolation for the orders table:

-- Drop the insecure policy
DROP POLICY "Order access" ON orders;

-- Create a secure policy restricted to the owner
CREATE POLICY "Users can view own orders"
ON orders
FOR SELECT
USING (user_id = auth.uid());

-- Ensure RLS is active (re-run to be safe)
ALTER TABLE orders ENABLE ROW LEVEL SECURITY;

Restrict profile access (optional but recommended):

DROP POLICY "Public read" ON profiles;

CREATE POLICY "Users can view own profile"
ON profiles
FOR SELECT
USING (id = auth.uid());

Next steps

1. Run the SQL fixes in your Supabase SQL Editor or include them in your next migration.
2. Verify that your orders table has a user_id column linked to auth.users.
3. Test the query from the frontend using a non-admin test account.

[Self-Check]

• RLS explicitly checked and enabled on all relevant tables
• Policies verified for strict user isolation using auth.uid()
• Service role key usage flagged if misused in client
• Exact SQL fixes provided for all identified flaws