Can users change their own plan or credits in my Supabase app?
Often, yes. If your profiles table lets users update their own row and the policy doesn't limit which columns, a signed-in user can set their own plan, credits or role through the API, without paying.
Why
A common AI-generated policy is 'users can update their own profile'. Row Level Security limits which rows they can change, but not which columns. If plan, credits, role or subscription fields live on that row, the user can change them with one request using their own session.
Limits enforced only in the UI (a disabled button after 5 projects) have the same problem: the API doesn't know about them.
The fix is to make those columns writable only by your server: revoke UPDATE on the table and grant it back only for the columns users may edit, or move billing fields to a table users can't write. Change plan and credits only from your payment webhook or a server function.
How to check
- List every table with an UPDATE policy for authenticated users, and the columns a user should not control.
- Apply column grants like the example below, adjusted to your editable columns.
- Shippable's code scan flags update policies on tables with plan, credits, role or similar columns.
Check your app
Your first app is free, and it is read-only. You prove the app is yours with a one-line tag first.
More questions
- Is the Supabase anon key safe to expose?
- How do I check if my Supabase tables are readable by anyone?
- Is my Lovable app secure?
- Does verify_jwt protect my Supabase edge functions?
Updated 2026-10-06.