Database / Supabase Intermediate to Advanced Interview Questions

Why doesn't disabling RLS on a table make it invisible in the auto-generated API docs?

PostgREST builds its schema introspection — and by extension the auto-generated API documentation Supabase Studio shows — directly from Postgres's catalog metadata: table names, columns, and types. That introspection happens regardless of whether RLS is enabled, because RLS is an access-control mechanism, not a visibility toggle for the schema itself.

Practically, this means a table with RLS disabled is still fully listed, documented, and queryable through the API exactly like any other table — the difference is that without RLS, every row is returned to every requester rather than a filtered subset. Disabling RLS doesn't hide the table; it removes the one thing that would have restricted what data flows through the API that already exposes it. This is precisely why leaving RLS off on a table containing sensitive data is a common and serious misconfiguration — the endpoint isn't hidden, it's just unfiltered.

Take quiz

What does PostgREST's API documentation actually introspect from? The Supabase billing dashboard

✗ Try again, that's not it.

A separate manually maintained OpenAPI file

✗ Try again, that's not it.

Postgres catalog metadata like table and column definitions

✓ Correct! Well done.

Only tables where RLS happens to be enabled

✗ Try again, that's not it.

What actually happens when RLS is disabled on a table, in terms of the API? The table stays fully queryable but every row is returned unfiltered

✓ Correct! Well done.

The table disappears from the API entirely

✗ Try again, that's not it.

The table becomes read-only

✗ Try again, that's not it.

The API refuses all requests to that table

✗ Try again, that's not it.

More Related questions...

How does Supabase expose custom Postgres functions as callable RPC endpoints? What is the difference between a SECURITY DEFINER and a SECURITY INVOKER Postgres function? How does pg_cron enable scheduled jobs directly inside a Supabase Postgres database? What is the difference between a read replica and the primary database in a Supabase project? When should you use a read replica versus scaling the primary database's resources? What is the difference between daily backups and Point-in-Time Recovery in Supabase? How does Supabase's database branching feature isolate schema changes per git branch? When would you choose a preview branch over testing migrations directly in staging? What is the difference between a custom access token hook and a raw JWT claim? Why should you avoid embedding sensitive business data directly inside JWT claims? How does Supabase support anonymous sign-ins, and how do you convert one to a permanent account? What is the difference between linking an OAuth identity and creating a brand-new user account? How is Storage object access controlled compared to table-level Row Level Security? What is the difference between resumable (TUS) uploads and standard uploads in Supabase Storage? How does Supabase's image transformation feature resize images without a separate CDN service? What is the difference between LISTEN/NOTIFY and Supabase Realtime's Postgres Changes channel? What is the difference between schema-per-tenant and RLS-based multi-tenancy? Why is EXPLAIN ANALYZE useful before optimizing a slow Supabase query? What is the difference between JSONB and a fully normalized relational schema in Postgres? When should you use a JSONB column instead of creating additional relational tables? How does wrapping auth.uid() in a subquery improve Row Level Security performance? Why do we use SECURITY DEFINER functions when RLS would otherwise block a needed operation? How does pg_net let Postgres make asynchronous HTTP calls without blocking a transaction? Explain the lifecycle of a Point-in-Time Recovery (PITR) backup in Supabase? How does a custom access token Auth Hook let you enrich a user's JWT with custom claims? How does Supabase enforce multi-factor authentication (MFA) at the session level? Why doesn't disabling RLS on a table make it invisible in the auto-generated API docs? Explain the internal working of Supabase Vault for storing encrypted secrets in Postgres? Why should you store third-party API keys in Vault instead of a plain table column? When should you choose LISTEN/NOTIFY over Supabase Realtime for internal service communication? How can you optimize a multi-tenant schema design using Row Level Security instead of schema-per-tenant? How do you troubleshoot a Postgres query that performs well in the SQL editor but slowly through the REST API? Explain the execution flow of a private Realtime broadcast channel authorized by Row Level Security? Why do private Realtime channels need their own RLS-style authorization check? How does Supabase's connection string differ between the direct connection, session pooler, and transaction pooler? Why doesn't the transaction pooler support prepared statements the way a direct connection does? How can you optimize zero-downtime schema migrations for a table already receiving production traffic? What happens when a long-running migration locks a table that's still receiving live writes? How does Supabase Studio's SQL editor differ from running migrations through the CLI in a CI pipeline? Which is better for production schema changes, editing directly in Studio or CLI-managed migrations, and why?

Show more question and Answers...

Apache Cassandra Intermediate and Advanced interview questions

Comments & Discussions

SQL 39 MongoDB Interview questions 31 REDIS 69 Apache Cassandra Interview Questions 27 Amazon DynamoDB Interview questions 6 InfluxDb interview questions 30 InfluxDb interview questions II 50 Vector database interview questions 45 PineCone Database Interview questions 50 PineCone Database Interview questions II 5 Snowflake Interview Questions 45 CouchDB Interview Questions 45 Liquibase interview questions 34 Azure Cosmos DB interview questions 34 ChromaDB Interview Questions 38 pgvector basics Interview Questions 40 Supabase basics Interview Questions 30 Supabase Intermediate to Advanced Interview Questions 40 Apache Cassandra Intermediate and Advanced interview questions 45 RocksDB Basics Interview Questions 47 Mnesia basics Interview questions 48 Mnesia intermediate to advanced Interview questions 48 SQLite Interview questions 48 Google Spanner Database Interview questions 50 ScyllaDB Interview questions 50 Qdrant Vector DB Interview questions 50

Recently added questions

What is an EntityManagerFactory? What is the EclipseLink shared cache (L2 cache)? What is the relationship between EclipseLink and Jakarta Persistence? What is an EntityManager in EclipseLink? How do you optimize EclipseLink performance for a high-throughput application? What is class weaving in EclipseLink? What is the difference between EAGER and LAZY fetch strategies, and how does EclipseLink implement lazy loading without a live session? What is JPA (Jakarta Persistence API)? Explain the internal working of EclipseLink's Unit of Work commit process? What is persistence.xml used for? What is a JPA entity? How do you configure batch fetching using EclipseLink query hints? What are EclipseLink's core components? What is EclipseLink MOXy? When should you use pessimistic locking instead of optimistic locking? How do you troubleshoot lazy loading failures caused by missing weaving in EclipseLink? What is the difference between JPQL and the EclipseLink native Expression/Criteria API? What is EclipseLink? What is a Persistence Unit in EclipseLink? How do you troubleshoot stale data issues caused by EclipseLink's shared cache?

	Interviews Questions Java Spring Hibernate DevOps Testing API BigData Web Erlang AI Database Integration Cloud Python Scala Tools Golang SAP	About Javapedia.net Javapedia.net is for Java and J2EE developers, technologist and college students who prepare of interview. Also this site includes many practical examples. This site is developed using J2EE technologies by Steve Antony, a senior Developer/lead at one of the logistics based company. Follow Javapedia updates
	contact: javatutorials2016[at]gmail[dot]com
Kindly consider donating for maintaining this website. Thanks.
	Copyright © 2026, javapedia.net, all rights reserved. Privacy Policy · Terms of Service.