user-feedback: correct UPDATE policy WITH CHECK fallback guidance

Edit skills/supabase/SKILL.md in Core Principles → Security checklist → RLS, views, and privileged database code → UPDATE policies. Read the linked PostgreSQL CREATE POLICY and Supabase RLS documentation first, then replace the introductory guidance while retaining the SQL example. Done means the text accurately explains the USING fallback for omitted WITH CHECK and links to the sources.

What happened

Task: Verify the Supabase skill's guidance on UPDATE row-level security policies.

Skill said: The security checklist states that UPDATE policies require both USING and WITH CHECK, and that omitting WITH CHECK allows a user to reassign a row's user_id to someone else.

Expected: PostgreSQL applies the USING expression to the proposed new row when WITH CHECK is omitted for an UPDATE or ALL policy. In the skill's example, the ownership predicate therefore still checks the new owner even without an explicit WITH CHECK.

Explicitly writing both clauses is valid and can improve clarity. The issue is the explanation that omission alone permits ownership reassignment, not the SQL example itself.

Both primary documentation sources describe the fallback:

• PostgreSQL CREATE POLICY, Description and UPDATE sections
• Supabase Row Level Security, UPDATE policies

Source

File: skills/supabase/SKILL.md

Section: Core Principles → Security checklist → RLS, views, and privileged database code → UPDATE policies.

The assertion is present in this immutable upstream revision and in the main-branch file retrieved on 2026-09-08. The installed skill file was compared with that historical upstream revision and matched byte for byte (SHA-256 1171386737b231610fa42485707272765c3516a9bbc0bd2c6c161a8cee3d7d33). This is not a locally introduced wording change.

Fix suggestion

Replace the introductory bullet while retaining the existing SQL example:

UPDATE policies check existing and proposed rows. USING determines which existing rows may be updated. WITH CHECK determines which proposed rows may be stored. For UPDATE and ALL policies, PostgreSQL uses USING as the check on proposed rows when WITH CHECK is omitted. Specify WITH CHECK explicitly when the new-row condition must differ, or to make the intended rule clear. The following example spells out the same ownership condition for both checks:

Link the explanation to the PostgreSQL documentation above.

This avoids false security findings based solely on an omitted clause. Effective authorization still depends on all applicable policies, policy composition, privileges and RLS bypass conditions; this report does not claim that arbitrary policy sets are secure.

Verification: Documentation and upstream/local source comparison. No new database runtime reproduction was performed for this documentation report.