Database readable without authentication
- area
- Supabase · table public.invoices
- client
- xxxxxxxxxxxx
- found
- xxxxxxxxxx
The invoices table had no row-level security. Anyone holding the public API key, which ships in every page, could list every customer’s invoices, names and amounts. No login needed.
how to fixTurn on row-level security and let each user read only their own rows.
alter table invoices enable row level security;
create policy "read own invoices"
on invoices for select
using (auth.uid() = user_id);