---
title: "Supabase says \"new row violates row-level security policy\""
description: "The table has RLS on but no insert policy, or the new row fails its WITH CHECK. How to find the table, add the right policy, and avoid the wrong fix."
url: https://whocanfixmyapp.com/problems/supabase-rls-blocking-insert
---

[Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Sign-in and accounts](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

# Supabase says "new row violates row-level security policy"

VC-29 · Supabase · Lovable · Bolt · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley)

Quick verdict

Partly fixable yourself. One policy in the Supabase dashboard, if you know the table.

- **How serious**: Medium
- **Fix it yourself?**: Partly, some steps need a developer
- **Typical cost**: $49–$800 one-off check, or €99–$990 for a single fix ([prices](https://whocanfixmyapp.com/pricing))
- **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10

**What you see.** Saving a form fails with new row violates row-level security policy, or code 42501, while reading data still works.

## Why it happens

Row Level Security is doing its job. Once RLS is enabled, Supabase blocks every read and write through the publishable key until a policy allows it. Reads often work because the agent added a select policy and stopped. Inserts need their own policy with a `WITH CHECK` clause, which decides what the new row is allowed to look like. Supabase says a missing grant or a `WITH CHECK` violation both raise error code 42501.

Common reasons the check fails: the row's `user_id` does not equal `auth.uid()` because the form never fills it in, the user is not signed in so `auth.uid()` is null, or the policy is scoped to the `authenticated` role while the app calls as `anon`. Lovable and Bolt both generate these policies with the AI, so one table has them and the next does not. Do not fix this by turning RLS off, and never by moving the secret key into the app.

## Fix it yourself

1. Read the full error in the browser console or the Supabase **Logs** page. It names the table.
2. In Supabase, open **Table Editor**, select that table, and open its policies. Look for one whose command is INSERT.
3. If none exists, add one for the `authenticated` role with `with check ((select auth.uid()) = user_id)`, using your real owner column name.
4. If one exists, check the form sends `user_id` set to the current user, and that the user is signed in when it runs. A null `auth.uid()` fails silently.
5. Ask the agent to write matching select, insert, update, and delete policies for every table that stores user data, then test with two accounts.

## When to get an engineer

Stop if the error appears on many tables, if fixing one policy breaks another, or if the app uses the secret key in edge functions to get around RLS. Tell the engineer the table names, the error text, and who should be allowed to write what. A single fix is €99–$990 within 1–2 days. A review of the policies on every table is a one-off check at $49–$800, and it is worth doing before launch.

## Top-rated companies for Supabase apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score).

- 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490
- 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299
- 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399

[All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers)

## Check these

DATA-01 · Critical

Access rules are on for every table

In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say `allow read, write: if true`.

DATA-03 · Critical

One user cannot open another user's records

Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result.

PAY-03 · High

Input is validated on the server

Forms that only check input in the browser accept anything sent directly to the API.

## Questions

### Can I just disable RLS on that table?

No. Without RLS anyone holding your public key can read and change every row in the table. Add the missing insert policy instead. It takes a few minutes.

### Why does the agent keep writing policies with using (true)?

Because that makes the error go away fastest. It also makes the table public. Ask for policies that compare (select auth.uid()) to the owner column, and check each one yourself.

Sources: [Supabase: Row Level Security](https://supabase.com/docs/guides/database/postgres/row-level-security); [Supabase: RLS performance and best practices](https://supabase.com/docs/guides/troubleshooting/rls-performance-and-best-practices-Z5Jjwv); [Lovable: Supabase integration](https://docs.lovable.dev/integrations/supabase).

**Lovable guide**

What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable).

**Same category**

- [Users can't log in on the live site](https://whocanfixmyapp.com/problems/users-cant-log-in-on-the-live-site)
- [Google sign-in fails with redirect_uri_mismatch](https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch)
- [Confirmation and password-reset emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive)
- [Users get logged out when they refresh the page](https://whocanfixmyapp.com/problems/users-get-logged-out-on-refresh)
- [Admin pages open to anyone with the link](https://whocanfixmyapp.com/problems/admin-pages-open-to-anyone-with-the-link)
- [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data)

[All sign-in and accounts problems](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

**Run every check**

The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.