This post was drafted with AI assistance. It comes from Try the Door, which sells kits for builders shipping apps made with AI tools. The whole check is below, free; one paragraph at the end names the kits.

If you built your app with Cursor, Lovable, Bolt or Replit on Supabase, run this before launch: can one signed-in user read another user's rows?

It hides for a simple reason. While you build, you are signed in as yourself. Every query returns your data, and that looks right. But "I can see my rows" and "only I can see my rows" are two different claims, and the happy path only tests the first.

Run this only on an app you own or are authorized to test.

Step 1. Make two accounts

In your own app, make two accounts, A and B. A second browser or a private window keeps both signed in.

Step 2. Give A a real row first

Sign in as A and create something real: a note, an order, a profile field. An empty result also comes back when A owns nothing, so an empty result alone proves nothing.

Step 3. As B, reach for A's data

Sign in as B and try each road to A's row:

  • open A's record by its URL;
  • look at any list or feed that could include it;
  • in your browser's network tab, repeat a request that loaded A's row, with A's id in it.

Step 4. Read the result

  • Pass: with A's row in place, B gets nothing of A's.
  • Fail: B sees A's row. Your row-level rules are not per-user on that table.

Why apps ship failing

Two common causes: row-level security (RLS) is off on the table, or a policy says, in effect, "any signed-in user can read". Both look fine when you only ever test as yourself.

The fix on Supabase

  1. Turn RLS on for each table that holds user data.
  2. Add policies where the owner column equals auth.uid().
  3. Re-test with A's row still in place. If B still sees it, check that the owner column is set on insert, and that it is the column your policy compares.

A Firebase note

Firestore rules do the same scoping job, and the same two-account test applies.

Your turn

What do you check before you launch? Tell us in the comments.

Try the Door sells two kits for this. Lock Down ($19, https://oebose.gumroad.com/l/fnribw) is a pre-launch test you run yourself on your own Supabase app. The RLS Policy Pack ($15, https://oebose.gumroad.com/l/xwoyrm) is copy-paste SQL policies for 12 table shapes; its 188 pgTAP checks all passed in a lab re-run on 2026-11-13, on PostgreSQL 16 with the pack's stand-in for Supabase, not on a live Supabase project. Run only on apps you own or are authorized to test. 30-day refunds. Not affiliated with Supabase.