Row-level security (RLS) means the database itself enforces who can read and write which rows. Even if an attacker crafts a malicious API call, Postgres will refuse to hand over rows they don't own. This is your most important line of defense.
/The rules to internalize
- 01Enable RLS on every table: No exceptions. Publish will refuse if you skip this.
- 02Write policies per operation: Separate policies for SELECT, INSERT, UPDATE, DELETE.
- 03Roles live in a separate table: Never store is_admin on the profile — use a user_roles table.
- 04Never trust the client: Anything that matters (totals, permissions, quotas) is calculated server-side.
The security scanner
Run a security scan before publishing. Lovable flags critical findings — missing RLS, exposed secrets, dangerous policies — and blocks publish until they're resolved.