Is my Supabase project affected?

The check

select
  case d.defaclobjtype
    when 'r' then 'tables'
    when 'S' then 'sequences'
    when 'f' then 'functions'
  end as object_type,
  a.grantee::regrole as role,
  string_agg(a.privilege_type, ', ' order by a.privilege_type) as privileges
from pg_default_acl d
cross join lateral aclexplode(d.defaclacl) a
where d.defaclrole = 'postgres'::regrole
  and d.defaclnamespace = 'public'::regnamespace
  and a.grantee in ('anon'::regrole, 'authenticated'::regrole, 'service_role'::regrole)
group by 1, 2
order by 1, 2;

Run it in the SQL Editor. Each row lists a role and the privileges it receives on new tables, sequences or functions that the postgres role creates in public. When it returns no rows, new objects grant nothing to the Data API roles until you grant access.

What the old defaults were

What turning exposure off leaves behind

• New tables keep truncate, references, trigger and maintain; new sequences keep update. The Data API does not use these.
• New functions stay callable by every role, because Postgres grants execute to PUBLIC through a global default.

Dates are from the Supabase changelog post published 2026-04-28, read 2026-11-10. We have not seen an official post confirming that the 2026-10-30 step finished for every project, so check your own project with the query on this page.

Sources

• Supabase docs: Securing your API, read 2026-11-10
• Supabase changelog: Breaking Change: Tables not exposed to Data and GraphQL API automatically (published 2026-04-28), read 2026-11-10