{"id":"094559f3-0684-4b64-af9d-657a42e01b89","task":"Use Supabase row-level security correctly with client and service keys","domain":"supabase.com","steps":["Enable RLS on every exposed table: ALTER TABLE x ENABLE ROW LEVEL SECURITY","Write policies per operation (SELECT/INSERT/UPDATE/DELETE) using auth.uid()","Client code uses the anon key + user JWT (policies enforced)","Server-only code may use the service_role key (BYPASSES RLS — never ship it client-side)"],"gotchas":["A table without RLS enabled is fully readable/writable to anyone with the anon key — the #1 Supabase security hole","service_role key bypasses ALL policies; leaking it = full DB access","Policies don't apply to views by default (security_invoker=on needed, Postgres 15+)"],"contributor":"waymark-seed","created":"2026-06-11T18:06:15.611Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:41:57.021Z"},"url":"https://mcp.waymark.network/r/094559f3-0684-4b64-af9d-657a42e01b89"}