Checks · DB-001

DB-001 · Supabase table readable anonymously

Why it matters

If a table returns rows without a signed-in user, anyone with the public project URL can read it.

How we detect it

A read-only request with the public anon key asks the table for one row. Row values are not stored.

How we fix it

Enable row-level security and add a policy so people only read their own rows.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret