16,326 Supabase databases were publicly readable: what UpGuard found and how to check yours

What actually happened

Every Supabase frontend ships a public key — the legacy anon key or the newer sb_publishable_ key. That is by design: the key identifies the project, and Row Level Security (RLS) decides what each request may read. When a table has RLS disabled, the public key reads everything in it.

Tables created in the Supabase dashboard have RLS on by default. Tables created with raw SQL — the way AI coding tools such as Lovable, Bolt, Cursor and Claude Code typically create them — do not, unless the SQL enables it. UpGuard found thousands of apps where that step never happened. TechCrunch’s examples included a U.S. valet service exposing license plates, an immigration-services contact list, and a database belonging to a consulate.

Check your project in five minutes

1. List tables with RLS disabled

select tablename
from pg_tables
where schemaname = 'public' and rowsecurity = false;

Any table in this list is exposed if your project still uses the old automatic grants (all projects created before May 30, 2026 do).

2. Look for policies that allow everyone

select tablename, policyname, cmd, qual, with_check
from pg_policies
where schemaname = 'public'
  and (qual = 'true' or with_check = 'true');

A policy with using (true) turns RLS on but lets everyone through. It is the most common “fix” an AI assistant writes when a query fails, and it is equivalent to having no RLS for that operation.

3. Test as an attacker would

curl "https://YOUR-PROJECT.supabase.co/rest/v1/profiles?select=*&limit=1" \
  -H "apikey: YOUR_PUBLISHABLE_KEY"

If this returns rows while you are not signed in, so can anyone who opens your site’s JavaScript and copies the key.

How to fix it

• Enable RLS on every table in public: alter table public.t enable row level security;
• Write explicit policies scoped to (select auth.uid()), separately for select, insert, update and delete.
• Move tables that never need client access out of public, or revoke their grants.
• Check storage buckets: a public bucket serves every file to anyone with the URL.
• Run Supabase’s Security Advisor and fix every RLS warning.

What Sekrd’s own scans show

In Sekrd’s anonymized dataset of 799 publicly reachable hosts scanned between March and September 2026, black-box checks found Supabase tables readable without authentication on a handful of hosts. External scans undercount this problem: without project credentials a scanner only sees tables the frontend happens to reference. The SQL checks above are the reliable test.