The Query Planner Trap: How Supabase RLS Policies Multiply Auth Function Calls

Supabase users often unknowingly write RLS policies that re-evaluate auth functions for every row scanned—a performance pitfall invisible on small datasets but devastating at scale. The fix is surprisingly simple: wrapping auth.uid() in a subquery lets the query planner extract it into an init plan that runs once per query, not per row. This article reveals the root cause and shows how automated tooling can catch optimization issues that slip through manual review.