Public env vars, the Supabase anon key, and row level security in Supabase
By ShipSecurely Editorial · Updated · How we make these guides
Enable row level security, then add policies for the roles the browser uses. The API keys guide says to write those policies for anon and authenticated , and that policies do not apply to a secret key.
Fix for Supabase
Enable row level security, then add policies for the roles the browser uses. The API keys guide says to write those policies for anon and authenticated, and that policies do not apply to a secret key. Grant only the commands each role needs. A table with a grant and row level security off is reachable by that role, which Securing your API states. The publishable key in the client does not replace the policies.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.