From the checkup catalog
Check whether Supabase tables are public
How a passive checkup uses the anon key already in your app to see if a table answers without a login.
Supabase ships an anon key to the browser on purpose. That key is not a secret. What matters is Row Level Security. If RLS is off, the anon key can read the table the same way your app does.
ShipCheck finds the project URL and the anon key in public JavaScript, then requests one row from common tables such as users, profiles, and orders. It sends select=id and limit=1. If the API returns a JSON array, the table is publicly readable. The row is thrown away. Nothing is written.
The fix is to enable RLS and add policies so each person only reads their own rows. Do not hide the table by renaming it, and do not put the service_role key in the client to “make it work.” The service role bypasses RLS.
After you change the policies, use Mark fixed and recheck. That probe does not spend a credit. A full weekly checkup still does.