Fix: Supabase RLS enabled, no policy (query returns empty array)

The Supabase advisor reports 'RLS Enabled No Policy' (lint 0008_rls_enabled_no_policy) when a table has row-level security switched on but no policies. In that state Postgres applies a default-deny rule: no rows are visible or can be modified through the API. Reads do not fail, they return an empty array, which is why this looks like a bug in your query. It is the safe failure, and the fix is to add a policy.

• An AI tool or the dashboard enabled RLS when it created the table, and no policy was written afterwards.
• A policy exists, but only for another role. A policy written to authenticated returns nothing to a visitor who is not signed in.
• The policy compares auth.uid() with a column that is empty in older rows, so those rows never match.
• The request reaches Supabase without the user's session, so it runs as anon. This is common in server routes and edge functions that build their own client.
• You have a filter in the query that matches nothing. Rule this out first, because it produces the same empty array.

1. 1Decide who should see the rows: only the owner, members of a team, or everyone.
2. 2Make sure the table has a column that records the owner, such as user_id, and that existing rows have it filled in.
3. 3Create a SELECT policy for that rule. Add INSERT, UPDATE and DELETE policies for the writes your app performs.
4. 4If the table is meant to be reachable only from your server, keep it locked and make that intent explicit with a policy that uses false.

create policy "Users can read their own notes"
  on public.notes for select
  to authenticated
  using ((select auth.uid()) = user_id);

create policy "No API access"
  on public.internal_audit_log for select
  using (false);

Test both directions on your own project. Signed in, you should get your rows. Signed out, the same request should still return an empty array. Find your project URL and publishable (anon) key in the dashboard, then run the request below without a user token.

curl 'https://YOUR-PROJECT.supabase.co/rest/v1/notes?select=*&limit=5' \
  -H 'apikey: YOUR_PUBLISHABLE_OR_ANON_KEY'