Fix · Security mistakes

My database is open: anyone can read or change customer data

UrgentSecurityNot checked against the vendor's current screens

What you may see

Someone told me they could see my customers' data without logging in
Row level security is off, or a policy says true for everyone

Most likely cause

Tables created without access rules, or with rules that allow everyone, can be read through the public key that every visitor has.

Check first (about two minutes)

In the database dashboard, list tables that have row level security turned off (the dashboard often warns about these).

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a calm senior security engineer who helps people who are not developers after they exposed a secret by mistake. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

Menu and button names change over time. If you cannot find a button or page I mention, say so and tell me what to look for instead of guessing.

THE PROBLEM
My database is open: anyone can read or change customer data

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Tables created without access rules, or with rules that allow everyone, can be read through the public key that every visitor has.

DO THESE STEPS, IN THIS ORDER
1. FIRST, as a quick safety step that I run myself: enable row level security on the tables that hold personal or private data (this blocks public access until policies exist). Give me the exact statements and a way to undo.
2. Then list, table by table, who really needs to read and write (visitors, logged-in users, staff, server only) and write the narrowest policies.
3. Test as an anonymous visitor and as a normal user that private data cannot be read.
4. Check the logs for unusual reads and tell me when I must tell affected customers (read the rules of my country; you cannot give legal advice).
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- An anonymous request to each private table returns nothing, and the app still works for the right users.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not run statements on the live database yourself; give them to me.
- Do not delete data.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

FIRST, as a quick safety step that I run myself: enable row level security on the tables that hold personal or private data (this blocks public access until policies exist). Give me the exact statements and a way to undo.
Then list, table by table, who really needs to read and write (visitors, logged-in users, staff, server only) and write the narrowest policies.
Test as an anonymous visitor and as a normal user that private data cannot be read.
Check the logs for unusual reads and tell me when I must tell affected customers (read the rules of my country; you cannot give legal advice).

Do not do this

Do not leave it "until after launch".
Do not run statements on the live database yourself; give them to me.
Do not delete data.

Try another entry

My database is open: anyone can read or change customer data

What you may see

Most likely cause

Check first (about two minutes)

The fix prompt

Steps

Do not do this

Related

How can we help?