YOUR SUPABASE IS PUBLIC

Summary from the TLDR Dev newsletter

This dev frequently finds Supabase projects with exposed credentials, which, due to a lack of proper Row Level Security (RLS), grant full access to sensitive user data within the database. This vulnerability is surprisingly common. It allows simple `curl` requests to retrieve all user information from unprotected tables. While users are responsible for RLS, Supabase's design could be improved with clearer warnings or default secure configurations to prevent the anon key from becoming a master key.