School · Module 2 · Lesson 1 of 4
Turn on Supabase RLS on every table
The publishable (anon) key is public. Without RLS, anyone with it can read and write your tables.
Supabase gives you a browser-safe key: the publishable key (sb_publishable_) or the legacy anon key. Row Level Security is what stops that key from reading every row. Enable RLS on each table, then add policies that use auth.uid().
A table with RLS on and no policies denies everything. That is safer than RLS off. Add SELECT/INSERT/UPDATE/DELETE policies that match how your app actually uses the table.
Firebase equivalent: lock down Cloud Firestore and Storage rules so request.auth.uid matches the document owner. Never leave rules as allow read, write: if true.