SECURITY DEFAULT · Supabase · Oct 30, 2026
Supabase stops exposing new public tables to the Data API (30 Oct 2026)
From 30 Oct 2026, new tables in the public schema of existing projects get no default grants for anon, authenticated and service_role, so the Data API and GraphQL return 42501 "permission denied" until you grant access.
What happens to your data
Nothing is deleted. Existing tables keep their grants; direct Postgres connections, RLS, and the storage, auth and realtime schemas are unchanged.
What to do
- In every migration that creates a public table, add the grants each role needs, e.g. grant select on public.your_table to anon.
- Enable RLS and add policies in the same migration.
- Watch for error 42501 "permission denied for table" after deploys.
Source (the vendor's notice): https://supabase.com/changelog/45329-breaking-change-tables-not-exposed-to-data-and-graphql-api-automatically