{"slug": "supabase-s-30-oct-change-the-next-table-your-ai-builder-creates-needs-a-grant-s", "title": "Supabase's 30 Oct change: the next table your AI builder creates needs a GRANT. Here's the 2-minute check.", "summary": "Supabase will stop automatically granting Data API access to new tables in the public schema on 30 October 2026, requiring an explicit Postgres GRANT before a table is reachable via supabase-js, REST or GraphQL. Existing tables keep their current grants, and row level security, storage, auth, realtime and custom schemas are unaffected. Supabase attributes the change to AI agents, CLI scripts and AI builders creating tables without human review, which made it easy to expose a table before it was secured; apps built on Lovable or Bolt that use their own Supabase projects should assume the change applies.", "body_md": "If your app was built with Lovable, Bolt or another AI builder on top of Supabase, one thing changes on **30 October 2026**: new tables stop being reachable from your app until they get an explicit Postgres `GRANT`.\n\nYour existing tables keep working. The one that breaks is the *next* table, for example when you ask your AI builder for a new feature on 31 Oct.\n\nEverything below is from Supabase's own changelog and docs, read on 28 Oct 2026. We haven't run the change on a test project.\n\nUntil now, Supabase granted `select`, `insert`, `update` and `delete` on every new table in the `public` schema to the `anon`, `authenticated` and `service_role` roles, so a table was reachable through the Data API (the REST/GraphQL layer that `supabase-js` calls) the moment it existed.\n\nSupabase's timeline ([changelog](https://supabase.com/changelog/45329)):\n\nWhat doesn't change, per Supabase: existing tables \"keep their current grants and stay reachable\", row level security works the same, `storage`/` auth`/` realtime`/custom schemas are untouched, and apps that only use a direct Postgres connection aren't affected.\n\nSupabase's stated reason is worth reading if you build with AI: agents, CLI scripts and AI platforms now create tables without a human reviewing the diff, and the old default made it easy to expose a table before it was secured.\n\nSupabase says you need to act if your app talks to `public` tables through the Data API (`supabase-js`, any client library, `/rest/v1/`, `/graphql/v1`), or if your migrations or AI coding tool create tables without `GRANT` statements.\n\nThat's most Supabase apps built with AI: the browser calls `…supabase.co/rest/v1/` directly and the AI writes the migrations. In our own test on 16 Oct 2026, Lovable's app ran on Lovable Cloud (Supabase-compatible) and Bolt's on Bolt Database (Supabase).\n\n**Not verified:** whether those managed backends get the change on the same date, or whether Lovable or Bolt now add grants for you. If you connected your own Supabase project, assume it applies.\n\n`…supabase.co/rest/v1/<table>`. A missing grant looks like this:\n\n```\n{\n  \"code\": \"42501\",\n  \"message\": \"permission denied for table your_table\",\n  \"hint\": \"Grant the required privileges to the current role with: GRANT SELECT ON public.your_table TO anon;\"\n}\n```\n\nThe `hint` names the role and the exact `GRANT` that's missing.\n\n`42501`, but the message \"new row violates row-level security policy\" is a row level security policy doing its job, not this change. We saw exactly that in Lovable's and Bolt's apps when a second user tried to write a row as the first user.\n\n```\nselect grantee, privilege_type\nfrom information_schema.role_table_grants\nwhere table_name = 'your_table';\n```\n\nSupabase says to treat these as one unit, in the same migration: \"If the grant is missing, Postgres rejects the query before RLS comes into play.\"\n\n```\n-- 1. Grant only what each role needs\ngrant select on public.your_table to anon;  -- only if logged-out visitors should read it\ngrant select, insert, update, delete on public.your_table to authenticated;\ngrant select, insert, update, delete on public.your_table to service_role;\n\n-- 2. Keep row level security on\nalter table public.your_table enable row level security;\n\n-- 3. Add the policies you need\ncreate policy \"users can read their own rows\"\n  on public.your_table\n  for select\n  to authenticated\n  using (auth.uid() = user_id);\n```\n\nThree things to avoid:\n\n`anon` by reflex.\nAn example we wrote, not a tested recipe:\n\nFrom now on, every time you create a new table in the Supabase public schema, put explicit GRANT statements in the same migration as the table, its row level security and its policies. Grant select, insert, update and delete to authenticated and service_role only where the app needs them. Grant select to anon only for tables that logged-out visitors are meant to read. Never turn row level security off and never grant to all tables in the schema at once. Now check the table [your_table], which returns error 42501 \"permission denied for table\": add the missing grants, keep RLS on, and list the grants and policies you added.\n\nThen reload with the Network tab open and confirm the 42501 is gone. Supabase also suggests updating your AI tool's system prompt, or using its agent skill, so grants are added by default.\n\nFull guide, with evidence labels: [Supabase's 30 Oct change: new tables need a GRANT](https://vibetierlist.com/guides/supabase-oct-30-data-api-change/). Related: [the two-account test](https://vibetierlist.com/guides/two-account-test/) (can user A see user B's data?).\n\n*Disclosure: we run VibeTierList, which tests AI app builders. Want someone to run checks like these on your live app? [Launch Check, $29](https://vibetierlist.com/launch-check/). It's separate from our rankings: your app is never ranked, and payment never changes a tool's score. Supabase didn't pay us.*", "url": "https://wpnews.pro/news/supabase-s-30-oct-change-the-next-table-your-ai-builder-creates-needs-a-grant-s", "canonical_source": "https://dev.to/vibetierlist/supabases-30-oct-change-the-next-table-your-ai-builder-creates-needs-a-grant-heres-the-2-minute-3c69", "published_at": "2026-10-28 11:04:43+00:00", "updated_at": "2026-10-28 11:11:21.630741+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "developer-tools", "ai-products"], "entities": ["Supabase", "Lovable", "Bolt", "Postgres"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/supabase-s-30-oct-change-the-next-table-your-ai-builder-creates-needs-a-grant-s", "markdown": "https://wpnews.pro/news/supabase-s-30-oct-change-the-next-table-your-ai-builder-creates-needs-a-grant-s.md", "text": "https://wpnews.pro/news/supabase-s-30-oct-change-the-next-table-your-ai-builder-creates-needs-a-grant-s.txt", "jsonld": "https://wpnews.pro/news/supabase-s-30-oct-change-the-next-table-your-ai-builder-creates-needs-a-grant-s.jsonld"}}