In an AuditAI article, the authors report applying 243 generated Supabase security migrations to real schemas. They say that in 239 cases, a stranger could do what the security finding described before the fix. But the excerpt does not establish whether the applications using those databases kept working: the authors say they did not run anyone’s app, and warn that changing a function to security invoker can break an app that relied on the owner’s rights.
What did the migrations fix?
The AuditAI authors report that, before the fixes, the security findings were reproducible by a stranger in 239 of 243 cases. That is a count from the authors’ reported tests, not a general success rate for generated migrations: the available account does not provide the full methodology, case composition, or definitions needed to interpret the other four cases.
As an Amazon Associate I earn from qualifying purchases.
Two specific findings in the excerpt concern database access paths:
- 152 of 152
SECURITY DEFINERfunctions were reported as runnable by either anonymous (anon) or logged-in (authenticated) users. - 34 of 34 tables without row-level security (RLS) were reported as readable and writable.
The figures and characterizations above are attributed to the AuditAI article authors; the article’s full text and methodology are not established by the available excerpt. Read the AuditAI article for the reported results.
#1 Best Overall
What broke?
The accessible account does not give a complete list of breakages or counts for them, so it cannot support a claim that a particular failure was common—or that every migration caused a failure. It does identify one compatibility risk: “We did not run anyone’s app, and a security invoker fix can break an app that relied on the owner’s rights.” The statement is attributed to the AuditAI article authors.
A security change can close a database privilege path while also changing what a function is allowed to do when application code calls it. In particular, a switch to invoker rights means the function runs with the caller’s privileges rather than relying on its owner’s privileges. Whether that is correct depends on the intended access model and how the application uses the function. The excerpt identifies this as a possible break, not a documented tally of application failures.
Rank #2
Why a database-side fix is not proof the app still works
The authors say they did not run the applications associated with the schemas. Their reported results therefore address whether the described database findings could be reproduced and whether generated changes were applied—not whether application workflows remained intact after the changes.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →That distinction matters when reviewing a migration: a security fix should block unintended access without denying the actions the application is supposed to perform. Check the actual schema and the application’s expected behavior rather than treating a generated migration—or a successful database change—as a complete compatibility test.
What to check before applying a generated security migration
- Confirm the finding against the real schema. Inspect the affected function, table, grants, and existing RLS policies. Supabase’s RLS policy guidance instructs policy authors to retrieve schema information first, usually for
public; generated SQL should be checked against the project’s actual objects. - Review who is meant to access each operation. Supabase distinguishes
anonrequests fromauthenticatedrequests. Decide which roles should be able to select, insert, update, or delete, rather than assuming one policy fits every operation. - Check policy clauses operation by operation. Supabase’s guidance uses
USINGfor SELECT and DELETE,WITH CHECKfor INSERT, and commonly both for UPDATE. It also advises against combining multiple operations in one policy. These are policy-authoring instructions, not an independent validation of the migrations in the AuditAI article. - Inspect function privilege behavior. For a change involving
SECURITY DEFINERorsecurity invoker, verify the intended caller and owner privileges, then test the application paths that call the function under the relevant roles. - Check migration history and recovery options. Supabase’s CLI backup and restore guide separates dumps of roles, schema, and data from migration history, and covers restoring customizations to managed
authandstorageschemas. It also notes that schema diff behavior differs betweenpg-deltaand legacymigra, so confirm which flow applies to the project before relying on a diff as a full record of its state. - Test both the security boundary and the application behavior. Verify that an unauthorized request is denied and that intended user workflows still succeed. Include the relevant request roles and database operations in those checks.
What the reported experiment establishes—and what it does not
The article excerpt supports a narrow but useful conclusion: the authors report that many of the findings they addressed corresponded to access a stranger could reproduce before the migration, including exposed functions and tables lacking RLS. It also makes clear that database-side remediation and application compatibility are separate questions.
It does not establish a complete taxonomy of breakages, exact counts for compatibility failures, or whether application behavior was preserved. The practical lesson is to treat a generated migration as a proposed security change: verify its target and privilege effect, then test the application’s expected behavior under the roles and operations it actually uses.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
