Software1 hOctober 13, 2026, 11:47

Supabase: public tables no longer auto-exposed to Data API from 30 October

Supabase is changing Data API defaults: new tables in the public schema will no longer be reachable automatically and will require an explicit Postgres grant. The setting is available for new projects since 28 April 2026 and applies to all existing projects on 30 October 2026. Existing tables keep their current grants.

DEV Community

Open source

Supabase: public tables no longer auto-exposed to Data API from 30 October

From 30 October 2026 new public tables need an explicit GRANT for the Data API
Without a grant PostgREST returns a 42501 error
Existing tables keep their current grants and stay reachable
Direct Postgres connections via ORM or psql are unaffected

#Supabase#PostgREST

Supabase stops auto-granting on Oct 30: new tables lose default API access

Security

UpGuard: 16,326 Supabase Databases Were Publicly Readable Due to Disabled RLS

Security

UpGuard: 16,000 Supabase databases publicly expose user data

Security

Supabase: public tables no longer auto-exposed to Data API from 30 October

Supabase stops auto-granting on Oct 30: new tables lose default API access

UpGuard: 16,326 Supabase Databases Were Publicly Readable Due to Disabled RLS

UpGuard: 16,000 Supabase databases publicly expose user data

Scan finds working service_role key in git for 58 of 154 public Supabase apps