Definition
RLS misconfig (row-level security misconfiguration) is the common 2026 failure mode where a Supabase or Postgres table is exposed through a public API without the row-level security policies needed to restrict access, leaking private rows to anyone with the anon key.
In Depth
Supabase's default posture requires developers to explicitly enable RLS and write policies per table; when a team ships a new table and forgets, the entire table becomes readable over the public REST endpoint. Several 2025 and 2026 incidents traced back to this pattern. Scavio's RLS exposed endpoint check discovers publicly reachable Supabase endpoints so security teams can audit them before attackers do.
Example Usage
The security engineer ran a Scavio sweep for RLS misconfig on the team's Supabase projects and patched two exposed tables that day.
Platforms
RLS Misconfig is relevant across the following platforms, all accessible through Scavio's unified API: