Supabase stops auto-granting on Oct 30: new tables lose default API access

Supabase announced that from October 30, 2026, new tables, views and sequences in the public schema will no longer receive automatic grants for the anon, authenticated and service_role roles. Developers must add explicit grants or requests will fail with error 42501. Existing tables keep their grants.

• From Oct 30, 2026, new public tables get no auto-grants for anon, authenticated or service_role
• Without an explicit grant, requests fail with error 42501 'permission denied for table'
• The revoke is narrow: truncate, references and trigger still go to anon and authenticated
• service_role bypasses RLS but not grants — 97 of 100 migration histories create a table it cannot access