Observed Signal · Jul 19, 2026 · Technical Advisory · Source: DEV Community · Impact: 3/5 · Sentiment: Negative
Infrastructure Market: Prisma and Drizzle bypass Supabase Row-Level Security
Prisma and Drizzle, when pointed at a Supabase project's DATABASE_URL, open direct PostgreSQL connections as the postgres role and therefore bypass Supabase Row-Level Security (RLS). On Supabase the postgres role typically owns migrated tables and has the BYPASSRLS attribute, so policies do not run for ORM queries. The Supabase JS/PostgREST path enforces RLS by running statements as unprivileged anon/authenticated roles. The article explains the mechanism, shows why FORCE ROW LEVEL SECURITY alone won't help if the connection role bypasses RLS, and gives three fixes: use supabase-js for user-facing data, set role and JWT claims inside transaction-scoped statements, or create a dedicated least-privileged login role without BYPASSRLS.
Technical guidance about ORMs bypassing Supabase RLS affects data isolation and security for projects using Supabase and ORMs; relevant to engineering teams responsible for tenant isolation and data access controls.
Wichtigste Kernpunkte & Evidenz
- Prisma and Drizzle open raw PostgreSQL connections using DATABASE_URL and log in as the postgres role by default.
- On Supabase the postgres role typically owns migrated tables and has the BYPASSRLS attribute, causing Postgres to skip Row-Level Security for that role.
- The Supabase JS client (via PostgREST) runs queries as unprivileged anon or authenticated roles, where RLS policies are enforced.
- Three recommended fixes: (1) use supabase-js for user-facing operations and treat ORMs as trusted server work; (2) inside a transaction use SET LOCAL ROLE plus set_config to emulate PostgREST; (3) create a dedicated least-privileged login role (no BYPASSRLS) for app connections.
- ALTER TABLE ... FORCE ROW LEVEL SECURITY forces the owner to evaluate policies but does not affect roles with BYPASSRLS.
Verknüpfte Unternehmen
2 verknüpfte UnternehmenPrisma
Entwickler-fokussierte Datenbank-Tools und eine verwaltete Dateninfrastruktur-Plattform für moderne Anwendungen.
“Prisma and Drizzle connect as the postgres role and bypass Supabase RLS entirely, so your policies never protect ORM queries....”
Supabase
Eine quelloffene Postgres-Backend-Plattform für Entwickler zur schnellen Erstellung und Skalierung moderner Anwendungen.
“Prisma and Drizzle open their own direct Postgres connection and log in as the `postgres` role, which owns your tables and carries `BYPASSRL...”
Ontology Mapping & Concepts
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.