Vibe-Code Rescue

Supabase returns an empty array [] but the table has data

Your Supabase query returns [] with no error even though rows exist? Row Level Security is on with no policy allowing the read.

Reviewed October 14, 2026

What it means in plain English

Supabase has a safety system called Row Level Security (RLS). When it's on and no rule allows a user to see a row, Supabase doesn't throw an error, it just quietly returns nothing.

Likely causes

  • RLS is enabled on the table but no SELECT policy exists. Supabase docs: once RLS is enabled, no data is accessible via the API with a publishable key until you create policies.
  • The policy only allows authenticated users, but the visitor isn't signed in (or their session expired, so auth.uid() is null).
  • The policy compares auth.uid() to a user_id column that's empty or holds a different value.

How to fix it, step by step

  1. Supabase dashboard → Table Editor → select the table and check whether RLS is enabled and what policies exist (or Database → Policies).
  2. Decide who should see the rows:
    • Public data (e.g. product list): add a SELECT policy for anon, authenticated with using (true).
    • Each user's own data: add a SELECT policy for authenticated with using ((select auth.uid()) = user_id).
  3. Example SQL (SQL Editor):
create policy "Users can view their own rows"
on public.todos for select
to authenticated
using ( (select auth.uid()) = user_id );
  1. Make sure rows actually have the correct user_id filled in when created.
  2. Don't fix this by turning RLS off or by putting the secret/service_role key in the browser; that exposes all your data.
  3. Lovable/Bolt: you can ask "Add an RLS SELECT policy so signed-in users can read their own rows in ", then review the SQL before running it.

    How to check it worked

    • Reload the page while signed in; rows should appear.
    • Sign in as a second user and confirm they can't see the first user's rows.

    Sources

    Can't fix it? Get help.

    If the steps didn't clear the error, send what the screen says. A person can take a look. This is a request for a paid fix, not an instant chat.

    Request a fix