Row-level policies
Row-level policies decide which rows a request can see or change. They run inside Postgres, so they protect a table no matter which service asked.
A table in the public schema with policies off can be read by anyone who has your publishable key.
Turn them on
alter table projects enable row level security;Write a policy
create policy "owners can read their projects"
on projects for select
to authenticated
using ( (select auth.uid()) = owner_id );Performance
Wrap auth.uid() in a sub-select, as above. Postgres then evaluates it once per statement instead of once per row, which is often a hundred times faster on large tables.
Is this helpful?