Can anyone read your Supabase tables?
Whether the Supabase tables your app uses can be read by anyone with your public key, without signing in.
Why it matters
This is the most common way AI-built apps expose customer data. The public key is in every visitor's browser, so a table without row level security, or with a policy that allows everyone, is open to anyone who looks.
How a survey checks it
Verified check: runs once you prove you own the site.
This is a verified check, and the one time we use a key we find: your site's own public anon or publishable key, only against the Supabase project your site uses. We ask each table for a row count with a HEAD request, so no row data is ever sent to us. We never use a service role or secret key.
How to fix it
- Switch on row level security for every table in the public schema.
- Write policies that compare the signed-in user with the row, for example "users can read their own orders".
- Check views and functions too: a view can read tables without applying their policies unless it is set up to.
Prefer us to do it? Ask for a fix quote
Common questions
Supabase says RLS is on. Why is a table still readable?
Row level security with a policy that allows everyone, such as "using (true)", is switched on but protects nothing. The check tests what actually happens, not the setting.
Do you see my data?
No. We only receive the number of rows in each readable table, never the rows themselves.