A plain-English guide to Supabase security, RLS misconfiguration, and why so many modern apps leak customer data.
Row Level Security (RLS) is a database feature that controls which rows each user is allowed to read or write. When RLS is enabled with correct policies, anonymous visitors only see what they're supposed to. When it's disabled — the default when you first create a table — anyone with your public key can read the entire table.
Every Supabase and Lovable app ships a public 'anon' key inside its front-end JavaScript. That's by design — but the anon key is only safe if RLS is switched on for every table. Without policies, that same public key becomes a master key that returns your entire database to anyone who inspects your app's code.
An 'exposed' table is one that returns real records to an unauthenticated request. If a table holds emails, passwords, payment details, or health data, an exposed table means that information is publicly readable right now — no login, no hacking, just a single HTTP request.
Yes. DeltaForsch only reads publicly available front-end code and sends the same read-only requests a browser would. We never modify, delete, or store your actual data.
No. Our scanner returns counts and table names only — never your actual records. We store the scan summary (severity, table names, counts) to generate your report.
In most cases you enable Row Level Security on the table and add a policy that restricts access. This is usually a few clicks in your Supabase or app dashboard and takes minutes.
Any app that uses a public Supabase backend, including apps built on Lovable and similar tools. We detect the Supabase project automatically.