Why Your Supabase Data Is Exposed (And You Don’t Know It)

Why Your Supabase Data Is Exposed (And You Don’t Know It) The four RLS mistakes that silently leak production data — and how to verify your policies actually work. In January 2025, security researchers found over 170 apps built with Lovable had exposed databases. Every user’s data — emails, messages, private records — was publicly readable by anyone with the project URL and the anonymous key. The anonymous key is embedded in every Supabase client-side app. It’s meant to be public. The cause wasn