Your app uses Supabase: what that means
Whether your app connects to a Supabase project from the browser with its public anon or publishable key.
Why it matters
Many apps built with Lovable, Bolt and similar tools use Supabase. Its public key is meant to be in the browser, which means every visitor can talk to your database directly. Your data is only as private as your row level security rules.
How a survey checks it
Passive check: part of every free survey.
We look for the Supabase project address and public key in your homepage and its scripts. This is reported for information, not as a problem. We do not contact your Supabase project during a free survey.
How to fix it
- Make sure row level security is switched on for every table, and that each table has policies for who may read and write which rows.
- Verify ownership of your site so the verified checks can test whether your tables answer without a login.
Prefer us to do it? Ask for a fix quote
Common questions
Is it bad that my Supabase key is visible?
No, the anon or publishable key is public by design. A service role or secret key would be a real leak.
How do I know my row level security is right?
The verified check asks each table your app uses for a row count without logging in. Readable tables are listed, and we never receive the data itself.