Supabase Adjusts Default Data API Permissions to Emphasize Declarative Security

According to a recent LinkedIn post from Supabase, the company is adjusting default permissions for new projects to move its platform toward more declarative code practices. The post indicates that, starting May 30, new tables in the public schema will no longer be automatically exposed to the Data API and will instead require explicit permission grants per role.

The company’s LinkedIn post highlights that permissions can be configured either through the dashboard or via SQL, with explicit Postgres grants described as reviewable and easier to manage. The post suggests this change may enhance security and governance by making role-specific privileges, such as for anonymous and authenticated users, more transparent within database migrations.

For investors, this shift implies a continued focus on robust, developer-centric tooling that could strengthen Supabase’s competitive position against other backend-as-a-service providers. By defaulting to explicit, auditable grants, Supabase may appeal more to security-conscious enterprises and regulated customers, potentially supporting higher-value adoption and retention over time.