Supabase security advisorSupabase: “Function Search Path Mutable” (lint 0011)

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why it is flagged, and the fix

1. 01

   The function has no search_path

   “Without a fixed search path, this function could behave unpredictably or be exploited to reference unintended database objects.” Supabase docs, Database advisors (0011)

   Without a fixed search_path, a function resolves names like profiles using the session’s path, which can differ by role or connection. Supabase rates this as a warning.

2. 02

   Set an empty search_path and qualify names

   “Remember that once you set the search_path = '' all references to tables/functions/views/etc in your function's body must be qualified with a schema name.” Supabase docs, Database advisors (0011)

   An empty search_path makes every name explicit. Write public.profiles, not profiles, and auth.uid(), not uid(). Functions from extensions need their schema too, for example extensions.uuid_generate_v4() or extensions.crypt(). Built-ins like now() still work.

   create or replace function public.handle_new_user()
   returns trigger
   language plpgsql
   security definer
   set search_path = ''
   as $$
   begin
     insert into public.profiles (id, email)
     values (new.id, new.email);
     return new;
   end;
   $$;

3. 03

   Security definer functions matter most

   A security definer function runs with its owner’s rights, often postgres. If it looks up names through the caller’s path, a caller who can create objects in a schema on that path could point it at their own table or function. Fix these first.

4. 04

   Fix it without rewriting the body

   If you only want to set the option, alter the function. It keeps the existing grants, which a drop and recreate would lose. Include the argument types for a function that takes arguments, such as public.my_fn(uuid, text). The body still has to use schema names, or it fails at runtime with relation does not exist, or function does not exist.

   alter function public.handle_new_user() set search_path = '';

Checked against the vendor’s docs on November 9, 2026: Supabase docs: Database advisors, 0011 function_search_path_mutable.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Supabase RLS enabled but still exposed · Supabase database error saving new user · Supabase relation does not exist · Supabase Edge Function 401