Materialized Views in API in Supabase

What goes wrong

Postgres materialized views cannot have row level security (RLS) policies. If one is in the public schema of your Supabase project, it is fully accessible through the API.

How it happens

The materialized view was created in the public schema, which the API exposes.

How to find it

List the materialized views in the public schema.

SELECT n.nspname AS schema, c.relname AS matview_name
FROM pg_class c
JOIN pg_namespace n ON c.relnamespace = n.oid
WHERE c.relkind = 'm'
  AND n.nspname = 'public';

How to fix it

Move it to a schema the API doesn’t expose, or restrict access with column-level privileges.

ALTER MATERIALIZED VIEW public.<matview_name> SET SCHEMA private;