Observed Signal · Jul 19, 2026 · Technical Advisory · Source: DEV Community · Impact: 3/5 · Sentiment: Negative
Infrastructure Market: Prisma and Drizzle bypass Supabase Row-Level Security
Prisma and Drizzle, when pointed at a Supabase project's DATABASE_URL, open direct PostgreSQL connections as the postgres role and therefore bypass Supabase Row-Level Security (RLS). On Supabase the postgres role typically owns migrated tables and has the BYPASSRLS attribute, so policies do not run for ORM queries. The Supabase JS/PostgREST path enforces RLS by running statements as unprivileged anon/authenticated roles. The article explains the mechanism, shows why FORCE ROW LEVEL SECURITY alone won't help if the connection role bypasses RLS, and gives three fixes: use supabase-js for user-facing data, set role and JWT claims inside transaction-scoped statements, or create a dedicated least-privileged login role without BYPASSRLS.
Technical guidance about ORMs bypassing Supabase RLS affects data isolation and security for projects using Supabase and ORMs; relevant to engineering teams responsible for tenant isolation and data access controls.
Key Takeaways & Evidence Grounding
- Prisma and Drizzle open raw PostgreSQL connections using DATABASE_URL and log in as the postgres role by default.
- On Supabase the postgres role typically owns migrated tables and has the BYPASSRLS attribute, causing Postgres to skip Row-Level Security for that role.
- The Supabase JS client (via PostgREST) runs queries as unprivileged anon or authenticated roles, where RLS policies are enforced.
- Three recommended fixes: (1) use supabase-js for user-facing operations and treat ORMs as trusted server work; (2) inside a transaction use SET LOCAL ROLE plus set_config to emulate PostgREST; (3) create a dedicated least-privileged login role (no BYPASSRLS) for app connections.
- ALTER TABLE ... FORCE ROW LEVEL SECURITY forces the owner to evaluate policies but does not affect roles with BYPASSRLS.
Connected Companies & Entities
2 Entities mappedPrisma
Developer database tooling and managed data infrastructure platform.
“Prisma and Drizzle connect as the postgres role and bypass Supabase RLS entirely, so your policies never protect ORM queries....”
Supabase
Open-source Postgres backend platform for application developers.
“Prisma and Drizzle open their own direct Postgres connection and log in as the `postgres` role, which owns your tables and carries `BYPASSRL...”
Ontology Mapping & Concepts
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.