Critical

Database open to everyone

Supabase or Firebase tables any logged-in (or anonymous) user can read and edit.

What it is

Backend-as-a-service databases are called straight from the browser. Without Row Level Security (Supabase) or strict security rules (Firebase), the public anon key can read or change every row in a table.

Why fast-built apps get it

RLS is off by default on new Supabase tables created with SQL, and test-mode Firebase rules allow everything. Generated code works perfectly in the demo, so nobody notices.

Before and after the cure

supabase/migrations/001_profiles.sqlVulnerable

create table profiles (
  id uuid primary key,
  email text,
  plan text,
  is_admin boolean default false
);
-- No RLS: the public anon key can select and update every row

supabase/migrations/002_profiles_rls.sqlCured

alter table profiles enable row level security;

create policy "Users read their own profile"
  on profiles for select using (auth.uid() = id);

create policy "Users update their own profile"
  on profiles for update using (auth.uid() = id)
  with check (is_admin = false);  -- can't promote themselves