Security · 19h ago
Prisma and Drizzle bypass Supabase RLS: here's the fix
Prisma and Drizzle connect as the postgres role, which owns tables and has BYPASSRLS, so Row Level Security is skipped on ORM queries. The Supabase JS client uses unprivileged roles through PostgREST, enforcing RLS. To fix, point your app's connection at a dedicated non-owner role with NOBYPASSRLS and keep auth checks in code.
Meridian48 take
This is a critical security gotcha for any Supabase user adopting an ORM — the assumption that RLS protects all access is false, and the fix is straightforward but easy to miss.
supabaseprisma