Supabase anon key in the frontend grants full read/write on every table
Row Level Security is disabledAI generators routinely ship Supabase projects with RLS off. The anon key is public by design, so with RLS off anyone can read and write every row in your database.
Symptom
No error. Nothing breaks. The app works perfectly. That is the danger - this failure is completely invisible until someone finds it.
Why it happens
Supabase's anon key is meant to be public and shipped to the browser; the security boundary is Row Level Security policies, not the key. AI code generators wire up the client correctly but frequently skip the policies, because the app works without them and nothing in the happy path fails. The result is that the publicly-shipped anon key grants full read/write on every table. Called out repeatedly in the corpus as the most dangerous AI default.
Fix
Enable RLS on every table, then write explicit policies. Verify by querying your own REST endpoint with only the anon key from an incognito session - if you can read another user's rows, you are exposed. Supabase's dashboard flags tables with RLS disabled.