Supabase changes on Oct 30, 2026. Will your app break?
On October 30, 2026, Supabase applies a new default to all existing projects: new tables in the public schema won't be visible to your app's API until you grant access.
What Supabase says, in plain English
- Existing tables keep their current access. Supabase says they "keep their current grants and stay reachable."
- New tables need one extra step. Supabase says new tables in
public"require an explicit opt-in (via a Postgresgrant) before the Data API can see them." - Who's affected: apps that use
supabase-jsor the REST/GraphQL Data API. App builders that use supabase-js (for example, many Lovable and Bolt apps) are in this group. Apps that only use a direct database connection (psql, an ORM, a server with a connection string) aren't affected. - Why it matters for AI-built apps: if your AI tool creates a new table after Oct 30 and doesn't add a grant, requests to that table fail with a "permission denied" (42501) error, and the feature that uses it breaks.
Sources: Supabase changelog: "Breaking Change: Tables not exposed to Data and GraphQL API automatically" and Supabase GitHub discussion #45329.
GreenLight My App is independent and not affiliated with or endorsed by Supabase, Lovable, Bolt, Cursor, Replit or v0. Product names are used only to describe compatibility. This page is educational and not a security guarantee.
The fix (for each new table)
grant select, insert, update, delete on public.your_table to authenticated; alter table public.your_table enable row level security; -- then add RLS policies so users only see their own rows
A grant lets your app reach the table, and Row Level Security decides which rows each user can see. You need both. Paste this into your AI coding tool: "For every new table in the public schema, add explicit GRANT statements for the roles that need it and enable RLS with owner-only policies."