# What is row-level security? > Row-level security (RLS) is a database rule that lets each signed-in person read only their own rows. Why customer portals and vibe-coded apps need it. Source: https://learn.ynteractive.com/content/glossary/row-level-security · Updated 2026-10-24 · Free from Stepthrough (https://learn.ynteractive.com) [Web apps](https://learn.ynteractive.com/content/glossary#topic-web-apps) · [AI glossary](https://learn.ynteractive.com/content/glossary) Quick answer Row-level security (RLS) is a set of rules inside a database that decides, row by row, who may read or change each record. With it, a customer who is signed in to a portal can read only the rows that belong to them, even though every customer's data sits in the same table. Last updated October 24, 2026 [Take the free module →](https://learn.ynteractive.com/courses/vibe-coding-for-business/10)Module 10 of the free [Vibe Coding for Business](https://learn.ynteractive.com/courses/vibe-coding-for-business) course, about 10 minutes. No account needed. Updated October 24, 2026 · By [Robert Breen](https://learn.ynteractive.com/content/about) ## Why it matters for a small business A customer portal needs three things: logins (who is this?), a database (the records live off the page) and rules (what may this person see?). Row-level security is the third. Without it, any signed-in customer could ask the database for every other customer's record. App builders such as Lovable use databases (Lovable Cloud is built on Supabase) where RLS is how access is controlled. When you ask for logins and a database, also ask for row-level security and then test it by signing in as two different customers. ## In a real lesson: Lovable: Check Logins, Data and Cost Before You Share an App In the free [shipping safely lesson](https://learn.ynteractive.com/content/lovable-ship-safely), a bookkeeping firm (made up) checks its client status demo before sharing it. Search code finds all three clients written into the page itself, although the security scan says no issues. Asked in Chat mode what a safe version needs, Lovable answers: client logins, the records in a Lovable Cloud database, and row-level security so each client can only query their own return while staff can see everyone. [Try this lesson free](https://learn.ynteractive.com/modules/lovable-ship-safely) or [read the step-by-step guide](https://learn.ynteractive.com/content/lovable-ship-safely). ## Common confusions ### RLS vs a login A login proves who someone is. RLS decides what that person may read. A portal with logins but no RLS still lets any signed-in client read every record. ### RLS vs hiding things on the screen Hiding a record on the page does not protect it: the browser still received it. RLS stops the database from sending it at all. ## Tips - Ask for RLS in the same prompt as logins and the database, not as an afterthought. - Test with two accounts: each should see only its own records, and a signed-out visitor should see nothing. - Never put real customer data in the page code to "start quickly". ## Related terms [Build vs buy](https://learn.ynteractive.com/content/glossary/build-vs-buy) · [Vibe coding](https://learn.ynteractive.com/content/glossary/vibe-coding) · [Lovable](https://learn.ynteractive.com/content/glossary/lovable) · [Frontend and backend](https://learn.ynteractive.com/content/glossary/frontend-vs-backend) ## More Web apps terms Secrets and environment variables · Submission states · [Typeform](https://learn.ynteractive.com/content/glossary/typeform) · [Web app](https://learn.ynteractive.com/content/glossary/web-app) ## Where you use it: free lessons - [Lovable: Check Logins, Data and Cost Before You Share an App](https://learn.ynteractive.com/content/lovable-ship-safely) (Lovable, 10 min) - [Lovable: Cut "Where's My Return?" Calls with a Status Page](https://learn.ynteractive.com/content/lovable-client-status-portal) (Lovable, 9 min) - [Add a Contact Form That Saves to a Database in Lovable](https://learn.ynteractive.com/content/lovable-contact-form-database) (Lovable, 8 min) - [Build a Private Dashboard from Your Data in Lovable](https://learn.ynteractive.com/content/lovable-dashboard-with-login) (Lovable, 9 min) ## Frequently asked questions **Do I need row-level security for an internal tool?** If everyone who can sign in may see everything, simple logins can be enough. As soon as different people should see different records, such as clients or staff in different teams, you need RLS. **Does a security scan check row-level security?** Scans flag common problems such as tables with no rules at all. They cannot know which person should see which record; only you can, so test it with two accounts. **What does RLS cost?** Nothing extra: it is a feature of the database. In Lovable, adding logins, tables and RLS rules uses build credits, and the database runs on Lovable Cloud credits (20 free a month on every plan in October 2026). [All AI glossary terms, A to Z](https://learn.ynteractive.com/content/glossary) · [Free prompt templates](https://learn.ynteractive.com/content/prompts)