Go back to automatic exposure

The documented rollback

-- 1) Restore defaults for future tables
alter default privileges for role postgres in schema public
  grant select, insert, update, delete on tables to anon, authenticated, service_role;

alter default privileges for role postgres in schema public
  grant usage, select on sequences to anon, authenticated, service_role;

-- 2) Fix tables created since the change
grant select, insert, update, delete on all tables in schema public to anon, authenticated, service_role;
grant usage, select on all sequences in schema public to anon, authenticated, service_role;

Block 1 restores defaults for future tables. Block 2 is needed because default privileges only affect future objects, so tables created since the change stay without grants until you grant them.

What this re-opens

• Every table in public, old and new, is granted to anon, authenticated and service_role for select, insert, update and delete.
• Any table without row level security becomes readable and writable by every visitor.
• Supabase's stated reason for the change is that tables were being exposed before they were secured.

To keep some tables private afterwards, Supabase says to revoke them one by one:

revoke all on table public.your_private_table from anon, authenticated, service_role;

This is the SQL from the changelog FAQ for projects that opted in early. We have not confirmed that Supabase keeps these restored defaults in place on a project after the 2026-10-30 enforcement.

The narrower route

Grant only the tables that need it, with the access each one needs. That is what the tool below writes, and it comes with a per-table rollback:

-- public.your_table: undo owner only
drop policy if exists your_table_select_own on public.your_table;
drop policy if exists your_table_insert_own on public.your_table;
drop policy if exists your_table_update_own on public.your_table;
drop policy if exists your_table_delete_own on public.your_table;
revoke select, insert, update, delete on table public.your_table from authenticated;
revoke select, insert, update, delete on table public.your_table from service_role;
-- RLS stays on. To turn it off as well: alter table public.your_table disable row level security;
-- Grants removed by "revoke all" are not known here. Old default: grant select, insert, update, delete on table public.your_table to anon, authenticated, service_role;

Sources

• Supabase changelog: Breaking Change: Tables not exposed to Data and GraphQL API automatically (published 2026-04-28), read 2026-11-10
• Supabase docs: Securing your API, read 2026-11-10