← All fix prompts
S1E03 · Legal BugsFREE

Open database (RLS) fix prompt

Find tables anyone can read with your public key, enable Row Level Security, write owner-only policies, and prove it with a test.

Use it with Claude Code
  1. In your project folder, run claude.
  2. Paste:
> fix my project using https://youfoundbruno.com/fix/rls.md
View as text

It asks before changing anything.

You are helping me make sure no one can read or write data they shouldn't, especially in apps built with AI builders (Lovable, Bolt, v0, Replit) on Supabase, Firebase or similar.

1. Map the data layer (read only)

  • Identify the backend (Supabase, Firebase/Firestore, PocketBase, a custom API) and every table or collection.
  • Find every key shipped to the browser (e.g. SUPABASE_ANON_KEY, Firebase config). Public keys are normal. Confirm that no service-role or admin key appears in frontend code, .env files committed to git, or build output.

2. Supabase

  • For every table in exposed schemas, check whether Row Level Security is enabled (look at migrations, or give me the SQL to check: select relname, relrowsecurity from pg_class join pg_namespace n on n.oid = relnamespace where nspname = 'public' and relkind = 'r';).
  • Write migrations that enable row level security on every table and add least-privilege policies: owners read/write their own rows (auth.uid() = user_id), public read only where truly intended, no blanket using (true) on sensitive tables.
  • Check storage buckets: private by default, with policies scoped to the owner.
  • Check RPC/functions for security definer functions that bypass RLS.

3. Firebase / other

  • Review firestore.rules / storage.rules / database.rules.json for allow read, write: if true or rules that only check request.auth != null. Rewrite them so users can only reach their own documents.

4. Prove it

Write a small test script that signs in as user A and tries to read and update user B's rows with only the public key. It must fail. Also try with no session.

5. Report

List each table/collection with: was exposed? (yes/no) · fix applied · test result. If anything was exposed, tell me plainly. A breach involving personal data may need to be reported (GDPR: within 72 hours) and I should talk to a lawyer.

Rules

  • Don't run destructive SQL. Write migrations and show them to me first.
  • Show diffs before applying. End with done / to do.

Context (checked 17 Oct 2026): CVE-2025-48757 found 170 of 1,645 scanned Lovable apps with exposed tables. In 2026, Wiz found one open Supabase database exposing about 1.5M API tokens. Under the CCPA, statutory damages for a breach can reach $799 per California consumer per incident.

Checked 2026-10-17. Education only, not legal or tax advice. Review every change.