What is Row-level security?

Also called RLS.

Row-level security is a rule inside your database saying which rows each user may see or change. Without it, anything that can reach the database can read all of it, no matter how careful your application code is.

In more detail

It matters most with hosted databases like Supabase and Firebase, where the database is reachable directly from the browser by design. Your application is not the only path to the data, so a check written in your application is not a check on the data. RLS moves the rule into the database, where every path has to pass it.

Why it matters for your site

A table with RLS switched off is readable through the public API using the key already in your page. The most common version of this is a table created during development, when the policy felt like something to add later.