All 30 Supabase advisor lints

Name, level and one-line summary for every lint, 0001 to 0030.

Lint	Level	Summary	Fix on this site
`0001_unindexed_foreign_keys`	INFO	Unindexed foreign keys	Not covered here
`0002_auth_users_exposed`	ERROR	User data exposed through a view	Not covered here
`0003_auth_rls_initplan`	WARN	Slow security policy detected	Not covered here
`0004_no_primary_key`	INFO	Table has no primary key	Not covered here
`0005_unused_index`	INFO	Unused index found	Not covered here
`0006_multiple_permissive_policies`	WARN	Multiple permissive policies on a table	Not covered here
`0007_policy_exists_rls_disabled`	INFO	Security policy not enforced	Grants vs RLS
`0008_rls_enabled_no_policy`	INFO	No access rules defined	Policy per command
`0009_duplicate_index`	WARN	Duplicate index found	Not covered here
`0010_security_definer_view`	ERROR	View bypasses row-level security	Views and security_invoker
`0011_function_search_path_mutable`	WARN	Unsecured function search path	Not covered here
`0012_auth_allow_anonymous_sign_ins`	INFO	Anonymous sign-ins enabled	Not covered here
`0013_rls_disabled_in_public`	ERROR	Table publicly accessible	Owner-only SQL
`0014_extension_in_public`	WARN	Extension installed in public schema	Not covered here
`0015_rls_references_user_metadata`	ERROR	Security policy relies on user-editable data	Not covered here
`0016_materialized_view_in_api`	WARN	Materialized view exposed in API	Not covered here
`0017_foreign_table_in_api`	WARN	Foreign table exposed in API	Not covered here
`0018_unsupported_reg_types`	WARN	Column type blocks Postgres upgrades	Not covered here
`0019_insecure_queue_exposed_in_api`	ERROR	Queue exposed without protection	Not covered here
`0020_table_bloat`	WARN	Excess table bloat detected	Not covered here
`0021_fkey_to_auth_unique`	ERROR	Foreign key blocks Auth upgrades	Not covered here
`0022_extension_versions_outdated`	WARN	Extension out of date	Not covered here
`0023_sensitive_columns_exposed`	ERROR	Sensitive data publicly accessible	Not covered here
`0024_permissive_rls_policy`	WARN	Security policy allows unrestricted access	Policy per command
`0025_public_bucket_allows_listing`	WARN	Detects public storage buckets whose broad SELECT policies on storage.objects make their contents listable.	Not covered here
`0026_pg_graphql_anon_table_exposed`	WARN	This object is visible in your GraphQL schema to anyone using the public anon key.	Check table grants
`0027_pg_graphql_authenticated_table_exposed`	WARN	This object is visible in your GraphQL schema to signed-in users.	Check table grants
`0028_anon_security_definer_function_executable`	WARN	This SECURITY DEFINER function is callable without signing in.	Function execute grants
`0029_authenticated_security_definer_function_executable`	WARN	This SECURITY DEFINER function is callable by signed-in users.	Function execute grants
`0030_autovacuum_disabled`	INFO	Detects tables where autovacuum_enabled=false has been set as a storage parameter.	Not covered here

Names, levels and summaries are copied from the lint documentation in the splinter repository (main branch) on the date under Sources. The dashboard may show a different release. "Not covered here" means the lint is outside what this site deals with, not that it is unimportant.

Count by level

Level	Lints
ERROR	7
WARN	16
INFO	7

No lint means "this table has no grant"

None of the 30 names describes a table that is missing its grants. A missing grant is not a security hole: it shows up as a 42501 error when your app calls the table. The lints point the other way, at objects that are reachable and should not be. Supabase's changelog says the Security Advisor flags tables affected by the 2026 change; we could not tell from the lint list which lint does that.

Run the lints yourself

The Security Advisor is in the dashboard. Supabase's docs also list a CLI command, supabase db advisors. For a plain list of every table with its grants and row level security state, use the free audit query.

Write the fix for your tables

One table is free. The whole schema with a rollback file is $9 one-time.

Paste schema SQL or table names

Waiting for a paste.

Who can reach each table

Your tables show up here, one row each, with a choice of who can reach them.

Start clean: revoke older grants from anon and authenticated first, as the Supabase guide does.

The SQL appears here as soon as a table is found.

Parsed in your browser. Your SQL is never uploaded, and no site or database is scanned.

Questions

Which lints are errors?

0002_auth_users_exposed, 0010_security_definer_view, 0013_rls_disabled_in_public, 0015_rls_references_user_metadata, 0019_insecure_queue_exposed_in_api, 0021_fkey_to_auth_unique, 0023_sensitive_columns_exposed.

Does granting a table to anon trigger a lint?

Granting alone is not one of the 30 names. A table in public with row level security off is lint 0013, and a table anon can select is visible in GraphQL introspection per lint 0026. Grant, enable row level security and add policies together.

Sources

splinter (Supabase Postgres linter): lint documentation, main branch, read 2026-11-10
Supabase docs: Advisors, read 2026-11-10
Supabase changelog: Breaking Change: Tables not exposed to Data and GraphQL API automatically (published 2026-04-28), read 2026-11-10