Fix Data API docs: least-privilege grants, RLS wording, broken redirect and nav link by Copilot · Pull Request #44061 · supabase/supabase

Copilot · 2026-03-23T03:43:49Z

I have read the CONTRIBUTING.md file.

YES

What kind of change does this PR introduce?

Docs update

What is the current behavior?

All SQL grant examples use grant all ... to anon, authenticated, service_role — overly broad and encourages insecure copy-paste
securing-your-api.mdx incorrectly states RLS applies to functions
redirects.js has a duplicate source: '/docs/guides/database/hardening-data-api' — the first entry (which wins) pointed to the now-deleted /guides/api/hardening-data-api page, breaking the redirect
Nav entry "Hardening the Data API" in the API Security section links to the deleted page

What is the new behavior?

Least-privilege grants across all SDK installing.mdx files, creating-routes.mdx, and quickstart.mdx:

-- anon gets read-only
grant select on public.your_table to anon;
-- authenticated gets CRUD
grant select, insert, update, delete on public.your_table to authenticated;
-- service_role is unrestricted server-side
grant all on public.your_table to service_role;
-- functions: execute for authenticated/service_role only
grant execute on function public.your_function to authenticated, service_role;

RLS wording fix (securing-your-api.mdx): scope RLS guidance to tables/views only; add a separate note that function access is controlled via EXECUTE grants and SECURITY DEFINER review.

Redirect consolidation (redirects.js): single redirect for /docs/guides/database/hardening-data-api → /docs/guides/api/securing-your-api; new redirect for the deleted /docs/guides/api/hardening-data-api → same destination.

Nav fix (NavigationMenu.constants.ts): replace broken "Hardening the Data API" link with "Data API" → /guides/database/data-api.

Additional context

Addresses review feedback on PR #42969.

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

vercel · 2026-03-23T03:43:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment, Open in v0	Mar 23, 2026 3:54am
zone-www-dot-com	Ready	Preview, Comment, Open in v0	Mar 23, 2026 3:54am

7 Skipped Deployments

Project	Deployment	Updated (UTC)
cms	Ignored	Mar 23, 2026 3:54am
studio	Ignored	Mar 23, 2026 3:54am
design-system	Skipped	Mar 23, 2026 3:54am
learn	Skipped	Mar 23, 2026 3:54am
studio-self-hosted	Skipped	Mar 23, 2026 3:54am
studio-staging	Skipped	Mar 23, 2026 3:54am
ui-library	Skipped	Mar 23, 2026 3:54am

supabase · 2026-03-23T03:43:57Z

This pull request has been ignored for the connected project xguihxuzqibwxjnimxev because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

… and nav Co-authored-by: SaxonF <1072756+SaxonF@users.noreply.github.com> Agent-Logs-Url: https://github.com/supabase/supabase/sessions/6b0f335a-3617-44ce-9f7a-4d4fa131d6e7

Copilot

Pull request overview

This PR updates Supabase Data API documentation and site routing to promote least-privilege Postgres grants, corrects RLS wording around functions, and fixes broken links/redirects for the removed “Hardening the Data API” page.

Changes:

Replace broad GRANT examples in multiple SDK “installing” docs with least-privilege table/function grants.
Correct “RLS applies to functions” wording and add guidance to use EXECUTE grants + review SECURITY DEFINER.
Fix broken redirect(s) and update docs nav to point users to the Data API guide.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
apps/www/lib/redirects.js	Consolidates/fixes redirects for removed hardening docs routes.
apps/docs/docs/ref/swift/installing.mdx	Updates SQL grant examples to least-privilege.
apps/docs/docs/ref/python/installing.mdx	Updates SQL grant examples to least-privilege.
apps/docs/docs/ref/kotlin/installing.mdx	Updates SQL grant examples to least-privilege.
apps/docs/docs/ref/javascript/installing.mdx	Updates SQL grant examples to least-privilege.
apps/docs/docs/ref/dart/installing.mdx	Updates SQL grant examples to least-privilege.
apps/docs/docs/ref/csharp/installing.mdx	Updates SQL grant examples to least-privilege.
apps/docs/content/guides/api/securing-your-api.mdx	Fixes RLS wording; clarifies function access control via `EXECUTE`.
apps/docs/content/guides/api/quickstart.mdx	Updates quickstart grants (but still contains an overly-broad `grant all` for client role).
apps/docs/content/guides/api/creating-routes.mdx	Adds least-privilege grant guidance (but ordering/text is contradictory re: RLS vs write grants).
apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts	Replaces broken “Hardening…” nav link with “Data API”.

Copilot · 2026-03-23T04:01:47Z

+      -- Allow read-only access for anonymous clients (write access requires RLS policies)
+      grant select on public.todos to anon;
+      grant all on public.todos to authenticated, service_role;


In this quickstart SQL snippet, grant all on public.todos to authenticated, service_role; is still an overly broad grant for client roles and conflicts with the least-privilege pattern used elsewhere in this PR (CRUD for authenticated, all only for service_role). Consider splitting this into explicit CRUD grants for authenticated and reserving ALL for service_role.

Also, the new note says “write access requires RLS policies”, but writes can work without RLS (it’s just insecure). Rewording to “to safely allow writes from clients, enable RLS + policies first” would be more accurate.

Suggested change

-- Allow read-only access for anonymous clients (write access requires RLS policies)

grant select on public.todos to anon;

grant all on public.todos to authenticated, service_role;

-- Allow read-only access for anonymous clients (to safely allow writes from clients, enable RLS + policies first)

grant select on public.todos to anon;

grant select, insert, update, delete on public.todos to authenticated;

grant all on public.todos to service_role;

Copilot · 2026-03-23T04:01:48Z

+-- Allow unrestricted access for the server-side service role
+grant all on public.todos to service_role;
+-- Important: enable Row Level Security and create appropriate policies
+-- before granting write access to client roles (see RLS guide)


The “Important” guidance about enabling RLS is placed after you already grant write privileges (insert, update, delete) to authenticated, and the text says “before granting write access” which is contradictory. To avoid insecure copy/paste, consider moving the RLS enablement + policy creation steps before the write grants, or change the note to reflect the actual order (e.g., “before using these write grants from clients”).

Suggested change

-- before granting write access to client roles (see RLS guide)

-- before using these write grants from client roles (see RLS guide)

Copilot · 2026-03-23T04:01:48Z

        { name: 'How API Keys work', url: '/guides/api/api-keys' },
        { name: 'Securing your API', url: '/guides/api/securing-your-api' },
-        { name: 'Hardening the Data API', url: '/guides/api/hardening-data-api' },
+        { name: 'Data API', url: '/guides/database/data-api' },


This nav link now points readers to /guides/database/data-api, but that page currently contains grant examples like grant execute on function public.your_function to anon, authenticated; and default-privilege examples granting broad table/function access. That conflicts with the least-privilege guidance updated in this PR (e.g., not granting function execute to anon). Either update the Data API guide to match the new least-privilege recommendations, or link to a page that already reflects the updated security guidance.

Suggested change

{ name: 'Data API', url: '/guides/database/data-api' },

{ name: 'Data API', url: '/guides/api/securing-your-api' },

Initial plan

7087589

Copilot AI assigned Copilot and SaxonF Mar 23, 2026

Copilot started work on behalf of SaxonF March 23, 2026 03:43 View session

Copilot AI mentioned this pull request Mar 23, 2026

Update Data API docs to include explicit grants #42969

Merged

fix: use least-privilege grants, fix RLS wording, fix broken redirect…

82518c9

… and nav Co-authored-by: SaxonF <1072756+SaxonF@users.noreply.github.com> Agent-Logs-Url: https://github.com/supabase/supabase/sessions/6b0f335a-3617-44ce-9f7a-4d4fa131d6e7

Copilot AI changed the title ~~[WIP] Update Data API docs to include explicit grants~~ Fix Data API docs: least-privilege grants, RLS wording, broken redirect and nav link Mar 23, 2026

Copilot AI requested a review from SaxonF March 23, 2026 03:49

Copilot finished work on behalf of SaxonF March 23, 2026 03:49

SaxonF marked this pull request as ready for review March 23, 2026 03:58

Copilot AI review requested due to automatic review settings March 23, 2026 03:58

SaxonF merged commit 0d2a019 into docs/data-api-updates Mar 23, 2026
13 checks passed

SaxonF deleted the copilot/sub-pr-42969 branch March 23, 2026 03:58

Copilot started reviewing on behalf of SaxonF March 23, 2026 03:59 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Fix Data API docs: least-privilege grants, RLS wording, broken redirect and nav link#44061

Fix Data API docs: least-privilege grants, RLS wording, broken redirect and nav link#44061
SaxonF merged 2 commits into
docs/data-api-updatesfrom
copilot/sub-pr-42969

Copilot AI commented Mar 23, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

supabase Bot commented Mar 23, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	-- before granting write access to client roles (see RLS guide)
	-- before using these write grants from client roles (see RLS guide)

	{ name: 'Data API', url: '/guides/database/data-api' },
	{ name: 'Data API', url: '/guides/api/securing-your-api' },

Uh oh!

Uh oh!

Conversation

Copilot AI commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I have read the CONTRIBUTING.md file.

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior?

Additional context

Uh oh!

vercel Bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supabase Bot commented Mar 23, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 23, 2026 •

edited

Loading

vercel Bot commented Mar 23, 2026 •

edited

Loading