Guide
How to check if your Supabase database is exposed
Your Supabase database is exposed if row-level security is off on any table, because the publishable key in your frontend can then read every row directly. You can check by opening the Supabase table editor and looking for tables marked as having RLS disabled, or by scanning your live app, which will try a read and report what came back.
Why an open Supabase table is dangerous
Supabase gives your browser a publishable key so the app can talk to the database. That key is meant to be public. What stops it from reading everything is row-level security, the rules that say which rows each user may see. With RLS off, the publishable key reads the whole table, so anyone who opens your app can query your data directly from the console.
Any table showing RLS as disabled is readable by anyone.
How to check
- In Supabase: open the Table Editor. Any table showing RLS as disabled is readable by anyone. This is the fastest manual check.
- From the outside: a scanner sends the same kind of request your app sends and reports whether real rows came back. This confirms the exposure the way an attacker would find it.
How to fix it
Turn on row-level security for every table that holds user or private data, then add a policy that limits reads to the rows a user owns. Supabase has this in the dashboard under each table's policies. Do the trusted writes from your server with the secret key, never from the browser.
After you change the rules, scan again to confirm the table is closed. Plaintext does this read check for you and tells you plainly whether your data is still reachable.
Frequently asked
Is Supabase secure without row-level security?
No. Without row-level security, the publishable key in your frontend can read and often write every row in a table. RLS is the control that makes Supabase safe to expose to the browser, so it must be on for any table with private data.
Can people see my Supabase data?
If RLS is off, yes. Anyone who opens your app can use the public key to query the table directly. If RLS is on with a correct policy, they can only see the rows the policy allows, usually their own.
How do I know if my Supabase RLS is working?
Check the Table Editor for tables with RLS disabled, then test from the outside by scanning your live app. A scan attempts a read the way an attacker would and reports whether protected rows came back.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes Supabase-backed apps leave open. The first scan is free.
Scan my app