Can strangers read your app's data?
If your app uses Supabase, the public anon key lives in the browser. That's normal.
But if Row Level Security (RLS) is off on a table, anyone with that key can read or change its data. AI builders often skip it.
The 5-minute fix
- In the Supabase dashboard, turn on RLS for each table.
- Add a policy so users only see their own rows (e.g.
auth.uid() = user_id). - Test by logging in as a second user and confirming you can't see the first user's data.
One catch: turning on RLS often breaks sign-up or login by accident, because the app can no longer create or read the user's row. So after you turn it on, make sure sign-up and login still work.
ShipSafe checks that for you, free.
— Amanda, ShipSafe