# Supabase: “Function Search Path Mutable” (lint 0011)
> The Supabase advisor flagged function_search_path_mutable. Set search_path = '' on the function and qualify every table name with its schema.
Canonical: https://app369.com/fix/supabase-function-search-path-mutable/
Last updated: 2026-11-09
Function Search Path Mutable is a Supabase security advisor warning for a Postgres function with no fixed search_path. The function then looks up tables by the caller’s settings. The fix is to set search_path to an empty string and use schema-qualified names.
**Short answer**
Recreate the function with set search_path = '', and change every table, function and type it uses to a full name such as public.profiles. Test the function after the change, because any name you missed now fails. Then run the advisor again.
Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
## **Why it is flagged, and the fix**
1. 01 ### **The function has no search_path**
> “Without a fixed search path, this function could behave unpredictably or be exploited to reference unintended database objects.” [**Supabase docs, Database advisors (0011)**](https://supabase.com/docs/guides/database/database-advisors?queryGroups=lint&lint=0011_function_search_path_mutable) Without a fixed search_path, a function resolves names like profiles using the session’s path, which can differ by role or connection. Supabase rates this as a warning.
2. 02 ### **Set an empty search_path and qualify names**
> “Remember that once you set the search_path = '' all references to tables/functions/views/etc in your function's body must be qualified with a schema name.” [**Supabase docs, Database advisors (0011)**](https://supabase.com/docs/guides/database/database-advisors?queryGroups=lint&lint=0011_function_search_path_mutable) An empty search_path makes every name explicit. Write public.profiles, not profiles, and auth.uid(), not uid(). Functions from extensions need their schema too, for example extensions.uuid_generate_v4() or extensions.crypt(). Built-ins like now() still work.```
create or replace function public.handle_new_user()
returns trigger
language plpgsql
security definer
set search_path = ''
as $$
begin
insert into public.profiles (id, email)
values (new.id, new.email);
return new;
end;
$$;
```
3. 03 ### **Security definer functions matter most** A security definer function runs with its owner’s rights, often postgres. If it looks up names through the caller’s path, a caller who can create objects in a schema on that path could point it at their own table or function. Fix these first.
4. 04 ### **Fix it without rewriting the body** If you only want to set the option, alter the function. It keeps the existing grants, which a drop and recreate would lose. Include the argument types for a function that takes arguments, such as public.my_fn(uuid, text). The body still has to use schema names, or it fails at runtime with relation does not exist, or function does not exist.```
alter function public.handle_new_user() set search_path = '';
```
Checked against the vendor’s docs on November 9, 2026: [Supabase docs: Database advisors, 0011 function_search_path_mutable](https://supabase.com/docs/guides/database/database-advisors?queryGroups=lint&lint=0011_function_search_path_mutable).
## **Rather hand it over?**
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)
[**All 127 Fiverr reviews**](https://app369.com/reviews/)
Related: [**Supabase RLS enabled but still exposed**](https://app369.com/fix/supabase-rls-enabled-still-exposed/) · [**Supabase database error saving new user**](https://app369.com/fix/supabase-database-error-saving-new-user/) · [**Supabase relation does not exist**](https://app369.com/fix/supabase-relation-does-not-exist/) · [**Supabase Edge Function 401**](https://app369.com/fix/supabase-edge-function-401-invalid-jwt/)
Questions
## **More on this error**
**Will the change break my app? **+
Only if the function uses a name without its schema. Add the schema to each name, then test the trigger or RPC once before you deploy.
**Can I set search_path = public instead? **+
It should clear the warning, but Supabase recommends an empty string, which forces fully qualified names and leaves nothing to look up.
**Can you fix it for me? **+
If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.
A different error?
## **Describe it and get a written quote**
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.
[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)