Is my Supabase database open for anyone to read?

Is my Supabase database open for anyone to read? It can be, if an AI coding tool built your app and Row Level Security (RLS) was never turned on for your tables. You can check in a few minutes, and the fix is usually small.

What you’re seeing

Most owners see nothing wrong. The app works. Users sign in, data shows up, and you ship it.

That’s the trap. An open database looks just like a working one. No error, no warning banner, nothing breaks.

UpGuard scanned about 300,000 Supabase domains and found 16,326 databases with tables readable from the public internet with no authentication. Over half showed signs of personal data.

A smaller case shows what this looks like in one app. In February 2026, The Register reported on an education app built with Lovable. It had 16 vulnerabilities, 6 of them critical, and exposed 18,697 user records, including 14,928 unique email addresses. The causes were missing RLS and inverted auth guards, which means the login checks were working the wrong way round.

If your app stores emails, names, orders or messages, you’re in the group that should check.

Why it happens

Your app can look finished while the database is still wide open. That gap usually comes from how the tables were made.

Tables made in the Supabase dashboard get Row Level Security turned on by default. Tables made through the API or raw SQL — the route most AI coding tools take — don’t.

So your app can pass every screen test and still leave its tables readable by anyone who knows how to ask.

A quick way to check this is to look in Supabase at whether RLS is on for each table, then test that table from a logged-out browser session.

Is my Supabase database open for anyone to read? The minimum fix

You don’t need to rebuild the app. Start with this list, in order.

1. Open Supabase and list every table in your app.
2. Turn on RLS for each table — no exceptions.
3. Add one policy per table that says who can read it and who can write to it.
4. Log out, then try to read each table without signing in. Nothing should come back.
5. Fix any table that still returns data before you move on.

Don’t just add a policy and assume it’s safe. A policy with the wrong condition can leave a table open while looking protected.

Don’t hide behind a secret key in your app code, either. Anyone who can read that code can use the key — and then your RLS rules don’t matter.

Don’t rely on the app hiding a screen or a button. If the table is readable, the screen is only hiding it, not protecting it.

When to get help instead

If you don’t know which tables hold personal data, or which policies your app actually needs, stop there.

Guessing at policies can lock out real users or leave a gap open. Get someone who has fixed this before to check the tables and policies with you.

If this is your app, contact me through https://israr-kundi.web.app