Supabase table readable by anyone with the anon key

Error

Data in a Supabase table can be fetched from the browser with only the public anon key, no login.

Fix

Row Level Security is off on that table. Enable it: ALTER TABLE my_table ENABLE ROW LEVEL SECURITY; then add explicit policies for what anon/authenticated may read or write. With RLS on and no policy, nothing is readable, which is the safe default. Check every table in the Supabase dashboard's security advisor.

Related fixes