diff --git a/supabase/migrations/20260428005239_2d5dd166-67e0-4072-b14a-6bad8450ceb2.sql b/supabase/migrations/20260428005239_2d5dd166-67e0-4072-b14a-6bad8450ceb2.sql
new file mode 100644
index 0000000..35960dc
--- /dev/null
+++ b/supabase/migrations/20260428005239_2d5dd166-67e0-4072-b14a-6bad8450ceb2.sql
@@ -0,0 +1,9 @@
+-- Remove overly-permissive public SELECT policy on payment_requests
+DROP POLICY IF EXISTS pr_select_public_by_id ON public.payment_requests;
+
+-- Authenticated users can see payment requests they created, or admins see all
+CREATE POLICY pr_select_owner_or_admin
+ON public.payment_requests
+FOR SELECT
+TO authenticated
+USING (is_admin(auth.uid()) OR created_by = auth.uid());
\ No newline at end of file