It does at least look like their docs for the equivalent policy are not vulnerable to this attack though https://supabase.com/docs/guides/database/postgres/row

It does at least look like their docs for the equivalent policy are not vulnerable to this attack though https://supabase.com/docs/guides/database/postgres/row-level-security#update-policies https://supabase.com/docs/guides/database/postgres/row-level... ie: The "Update Policies" DSL ensures that the user does not change the user id of a row