The table anyone can read
Your app uses straight from the browser. A stranger posts a screenshot of your whole users table on X.
This answers: Why can anyone read my Supabase table? No coding needed. 3 quick decisions.
- Who may see what
- Where your data lives
- Keys and secrets
Checking your access…
Why can anyone read my Supabase table?
Your publishable (anon) key ships to every browser on purpose. decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().
Breaks at Database: RLS off: the public key reads every row
How it works
| Order | Owner | Total | Maya sees it? |
|---|---|---|---|
| #1042 | Maya | £120 | Yes, hers |
| #1043 | Tom | £80 | Yes: leaked |
| #1044 | Ana | £215 | Yes: leaked |
| #1045 | Maya | £42 | Yes, hers |
Why AI tools write this bug
When hides rows or blocks a write, the quickest way for an AI tool to make the problem disappear is to disable RLS or add a policy that allows everything. The app works again, for everyone.
How to fix it
- Enable on every table in the public schema.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Is it safe that the Supabase anon key is in my frontend?
- Yes, if Row Level Security is on with correct policies. The key identifies your project; the policies are what protect the data.
- Does a policy of auth.role() = 'authenticated' protect user data?
- No. Anyone can sign up and become authenticated. Policies must compare the row's owner with auth.uid().