{
  "slug": "supabase-cli-stops-auto-exposing-new-public-schema-objects-c43734a8eeb5",
  "title": "Supabase CLI stops auto-exposing new public schema objects",
  "tools": [
    "supabase"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-11T12:01:55.000Z",
  "announced_at": "2026-06-11T12:01:55.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating a `public` schema object that should be reachable through the Data API, add explicit `GRANT`s for the roles that need access. For temporary legacy behavior, set `[api].auto_expose_new_tables = true` in `config.toml`; the flag is deprecated and scheduled for removal.",
    "examples": [
      "GRANT SELECT ON public.<table_name> TO anon;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.<table_name> TO authenticated;\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.<table_name> TO service_role;",
      "[api]\nauto_expose_new_tables = true"
    ],
    "gotchas": [
      "Version: v2.106.0",
      "GRANT <privileges> ON <object> TO <role> (required): Give the named role the specified privileges on the object; choose privileges and roles according to intended access.",
      "[api].auto_expose_new_tables: When true, newly created public-schema objects are automatically reachable through the Data API roles; deprecated and scheduled for removal 2026-10-30.",
      "Prerequisite: Use a Supabase CLI version that supports `auto_expose_new_tables`; the official release discussion identifies v2.102.0 as the version that added the setting.",
      "Prerequisite: Enable RLS and add appropriate policies for exposed tables; grants and policies are separate access checks.",
      "When `[api].auto_expose_new_tables` is unset, it resolves to `false`.",
      "Local start/reset flows revoke default Data API privileges for newly-created tables, sequences, and functions in `public`.",
      "The deprecated `auto_expose_new_tables = true` setting is scheduled for removal."
    ]
  },
  "why_it_matters": "When creating public schema objects that should be accessible through the Data API, configure their intended role access.",
  "before": "New public-schema objects were automatically exposed through the Data API by default.",
  "sources": [
    "https://github.com/supabase/cli/releases/tag/v2.106.0",
    "https://supabase.com/docs/guides/api/quickstart",
    "https://github.com/orgs/supabase/discussions/45329"
  ],
  "rank": 0.93072,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "backfill-20261007",
    "verdict_id": "backfill-20261007:backfill-20261007-948f92380dd2de9b-0:gate",
    "evidence_hash": "27ec97e07f0aebe42050260c3f2aced4910a31f81af3d92a163c848cb1d16b1d"
  },
  "review": {
    "draft_hash": "f103bcbe6a83a167f5abd1814af65dbf547a0b7ca6ff2cf57cd9d14475dc3ebf",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "backfill-20261007:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.77 (>= 0.6 needed)."
  }
}