I scanned my own Supabase project and found 17 tables anyone could read with the anon key

Short summary

A developer discovered 17 Supabase tables exposed to anonymous API access due to disabled Row Level Security—a vulnerability pattern that becomes auto-prevented October 30, 2026. They released an open-source Node.js auditor tool that scans locally without sending credentials externally and integrates with CI/CD pipelines. The post includes SQL fixes and explains root causes of this security misconfiguration.

• •Developer found 17 exposed tables in their Supabase project due to disabled RLS and default anonymous grants
• •Released open-source CLI auditor tool with HTML reporting, local execution, and CI/CD integration
• •Provides SQL fixes and explains why this happened; October 30 deadline for enforcing new defaults

Generated with AI, which can make mistakes.