Home / RLS / Why is my table public? (RLS off)

Supabase RLS · Leak

Why is my Supabase table public? (RLS is off)

01 The anon key is public — that's by design

Supabase's anon key is meant to ship in your frontend. It's not a secret. The thing that stops it from reading everyone's data is RLS. So a table with RLS off is readable by anyone who opens your site's network tab and copies that key. This is the single most common Supabase data leak.

02 See the leak in one command

terminal

# with RLS off, the public anon key returns every row
curl "$SUPABASE_URL/rest/v1/notes?select=*" \
  -H "apikey: $ANON_KEY"
-- → returns ALL rows, from every user

If that returns data you expected to be private, the table is public.

03 Confirm which tables are exposed

audit.sql

select tablename
from pg_tables t
join pg_class c on c.relname = t.tablename
where t.schemaname = 'public'
  and c.relrowsecurity = false;   -- RLS is off

04 Close it

migration.sql

alter table notes enable row level security;

create policy "owner reads own notes" on notes for select
  using (user_id = (select auth.uid()));

Then re-run the curl as an anonymous caller — it should now return an empty set. To make sure a new table can never ship like this again, add an RLS gate in CI.

FAQ