I scanned my own Supabase project and found 17 tables anyone could read with the anon key

I run two SaaS products on Supabase. I've been on the platform for over a year. I'd like to think I know what I'm doing. Then Supabase published the May 2026 update about tables in public no longer auto-exposing to the Data API. Two deadlines: May 30, 2026 — new behavior is the default for all new projects. October 30, 2026 — enforced on all existing projects . My first reaction: "ok cool, doesn't affect me, I have RLS on everything." Then I thought about it for a minute and went, "wait, do I?"