Supabase anon key can read other users' rows
The anon key is supposed to be in the browser. It is not a secret. What must be secret is the data. A request with only that key should not come back with someone else's email, notes, or invoices.
Why this happens
- Row level security was never enabled on the table.
- A policy says using (true) for select, which means every role can read every row.
- A view was created with security invoker off, so it bypasses the table policies.
What ShipWatch looks for
- When ShipWatch finds a Supabase URL and anon key in the public JavaScript, it requests common tables.
- Any JSON array with rows is a failed check, with the table name in the report.
Prompt to paste
The Supabase anon key can read rows without a logged-in user. Enable RLS on every exposed table. Add a select policy that requires auth.uid() to match the owner. An anonymous request should return an empty array or an error.