Security advisor
What the security advisor checks — tables without policies, rules that let anyone in, public writes and reads, unprotected buckets — what each finding means and how to fix it.
The advisor reads your access policies, tables and buckets and lists what looks open. Open it from Policies › Security advisor. Every finding links straight to the fix.
| Finding | Severity | Means | Fix |
|---|---|---|---|
| Table has no access policies | Critical | No rule covers the table; app users are refused unless it has forced row-level security, and anything you add later may open it wider than you meant. | Add policy opens Policies with the table filled in. |
| Policy allows unrestricted access | Critical | A rule is ALLOW IF True: anyone, any action. | Narrow it to a resource, an action and a caller (Policy language (SPL)). |
| Policy may allow public write access | Critical | A rule lets anonymous callers insert, update or delete. | Require ctx.actor.is_anonymous == False, or limit to INSERT for forms (Security recipes). |
| Policy may allow public read access | Warning | Anonymous callers can read the resource. | Fine for public catalogues; otherwise require sign-in. |
| Bucket has no storage policies | Warning | Only the bucket's public flag decides access. | Add a preset on the bucket's Policies tab (Storage). |
| Public bucket lacks a public-read policy | Info | The bucket is marked public but no rule says so explicitly. | Add a public-read rule so the intent is recorded and simulated. |
Findings that need judgement (a public read may be intended) offer Validate with simulation, which runs real requests as each user type — Simulate access before you ship.
After fixing
The advisor re-checks every time you open it, so a fixed finding disappears on the next visit. A Simulation run also re-checks the project's settings (sign-up, CAPTCHA, rate limits) and lists anything that lets more people in than you may expect.