Guide
Supabase Row Level Security (RLS): the check every AI-built app needs
What the Supabase anon key can do, why RLS matters, and how to verify it before launch.
The anon key is public, by design
Supabase front-ends use the project URL and anon (publishable) key in the browser. That's expected. Access control comes from Postgres Row Level Security policies.
If a table in an exposed schema has RLS disabled, anyone with your anon key can query it through the Supabase API.
How to verify
In the Supabase dashboard, open Table Editor or Authentication → Policies and confirm RLS is enabled on every table in the public schema.
Add policies that limit rows to the signed-in user, for example auth.uid() = user_id, and test them while signed out.
Supabase's Security Advisor also flags tables without RLS.
What StackSiren does (and doesn't)
StackSiren detects a Supabase URL and key in your public code and reminds you to verify RLS. It never queries your database. A service_role key found in front-end code is flagged as critical, because it bypasses RLS entirely.