What is row-level security?
The single most common gap we find in AI-built apps, explained in plain terms.
This is a sample entry. The structure is final; the full write-up is on its way.
In short
Row-level security is a database rule that decides, per row, which users may read or change it. Because the database enforces it, the rule holds no matter how the request arrives — through your app, through an API call, or through someone else's script.
Also called: RLS, Row security policies
Why does it matter more in AI-built apps?
A generated app usually looks correct because the interface only shows each person their own data. That is a display decision, not a security one. Without row-level security, anyone who can reach the data layer directly can read everything in the table.
What a policy looks like in practice
A policy answers one question per operation: given this user, may they select, insert, update or delete this row? Enabling security with no policy denies everything. Writing policies without enabling security protects nothing. Both halves are required.
Common questions
Does enabling row-level security slow the database down?
Barely, when the columns the policies filter on are indexed. The cost of not having it is considerably higher.
More on this: Production architecture & security · All glossary terms
Built something in Lovable you want people to rely on?
We are the engineers who take it the rest of the way — secured, tested, released and supported.