Can anyone read your Supabase tables?

The key in your website is public by design. Whether it can read your customers' data depends only on Row Level Security. Check every table in under a minute.

  • Runs in your browser: your key never reaches us
  • Shows table and column names, never your data
  • Free, no sign-up

Find both in Supabase under Project Settings → API Keys. This is the key already inside your website.

Runs in your browser. Your key is never sent to LogicTrail.

Why AI-built apps leak tables

Apps made with Lovable, Bolt, Cursor or Claude Code usually talk to Supabase straight from the browser, using the public key. That is fine, as long as every table has Row Level Security switched on with a policy that says who may see which rows.

AI tools often create a table to make a feature work and skip the policy, or switch RLS off to make an error go away. The app works perfectly in every test, because you are the only user. The leak only shows when a stranger opens the developer tools.

How to fix a readable table

  1. In your Supabase dashboard, open the table and turn on Row Level Security (RLS) for it.
  2. Add a select policy that only returns rows the signed-in user owns, such as auth.uid() = user_id.
  3. Do the same for insert, update and delete: each has its own policy.
  4. Run this check again. The table should now say "No rows came back" or "Locked".

Then paste your policies into the RLS policy checker to see what each one really allows.

Questions

Is it safe to paste my Supabase anon key here?
Yes. The anon (or publishable) key is already inside your website for anyone to copy; that is how Supabase works. The check runs in your browser and talks only to your project. Never paste a service role or secret key, anywhere: this page refuses them.
What does 'Anyone can read it' mean?
The table returned rows to a visitor who is not signed in. Anyone who opens your site can copy your public key and download every row the same way. Turn on Row Level Security for the table and add a policy that only returns each user their own rows.
My tables say 'No rows came back'. Am I safe?
Probably, for reading: Row Level Security is on and returns nothing to anonymous visitors, or the table is empty. Writing, updating and deleting have their own policies, so check those as well.
Why did it only check some tables?
Many projects hide their table list from the public key, which is good practice. The checker then tries the table names AI tools use most. Add your own table names to check those too.