Why your app’s key is public, and why that’s fine
Apps built on Supabase talk to the database straight from the visitor’s browser, using the “anon” (or “publishable”) key. Anyone can find that key in your website. That’s by design: the key only says “this request comes from your app”. What a request may actually do is decided by the rules on each table.
What a rule looks like, in words
A rule is a sentence the database checks on every request. Written out, good rules sound like this:
- “A person can read their own orders.” (not everyone’s orders)
- “A person can edit their own profile, but not the ‘plan’ or ‘is admin’ fields.”
- “Anyone can read published blog posts; only the author can read drafts.”
If you can’t say the rule for a table in one sentence like these, that table probably needs a closer look.
Check every table in five minutes
Open the Security Advisor
In Supabase, go to Advisors → Security Advisor. Any table listed with row level security disabled is readable by anyone who has your public key.
Look at each table’s policies
In Authentication → Policies (or the table editor), every table that holds user data should have row level security turned on and at least one policy. Turned on with no policies means nobody can read it through the app, which is safe but may break a feature.
Watch for “true”
A policy whose condition is simply true lets everyone through. That’s fine for genuinely public content, and a problem anywhere else.
Test as two people
Sign in as user A, then try to load user B’s data by changing an ID in the address or the app. You should see nothing.
Fixing it with your AI builder
Ask for one table at a time and say the rule in plain words, for example: “Turn on row level security for the orders table. Users can only read and create their own orders, matched on user_id. Nobody can update or delete orders from the app.” Then test as two users again.
Rules interact with features in ways that are easy to miss, such as admin screens, shared items and teams. If your app has any of those, an engineer’s review is worth it before you launch.