Least-privilege database grants

Enabling Row Level Security (RLS) alone is not sufficient to secure a new table—Postgres/Supabase grants default privileges to roles like anon and authenticated that can allow unintended access even with RLS enabled unless explicit policies are also defined. When creating tables for sensitive or system-level data, always explicitly revoke default privileges from public-facing roles immediately after creation, then add only the specific policies needed for legitimate access. For example:

ALTER TABLE public.system_config ENABLE ROW LEVEL SECURITY;
REVOKE ALL PRIVILEGES ON TABLE public.system_config FROM anon;
REVOKE ALL PRIVILEGES ON TABLE public.system_config FROM authenticated;

Follow this pattern for any new table, especially configuration or internal-use tables, to enforce least-privilege access and avoid accidental data exposure through default role grants.</description> </invoke>