Your Supabase anon key can probably read your whole users table
Here is a Supabase row-level security policy. It was on a profiles table holding names, timezones and weekly availability for real people. create policy "profiles are viewable" on public . profiles for select using ( id = auth . uid () or not public . blocked_with ( id ) ); It reads as: you can see your own row, and anyone who hasn't blocked you. That is what it does — for a signed-in caller. For…
Your Supabase anonymous key can likely read the complete users table. This occurs because of a row-level security policy that allows viewing own rows and users who haven't blocked the caller. For callers without a session, the `auth.uid()` returns null, making the condition always true, granting full access. This was explained in a migration that justified a decision, but the policy ended up allowing access to users' schedules.
The issue is that the page requires a session, affecting the marketing page's ability to show numbers accurately. To fix this, a function `track_counts()` was created to return only the counts without revealing individual rows. This approach ensures that only the required aggregate data is accessible anonymously, without compromising user privacy.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
