Supabase client configuration visible

The anon key is designed to be public — it sits in the browser in every Supabase app. Finding it is therefore not a defect but a status check: from here on, your entire data security rests on Row Level Security, not on the login screen.

This is the most underestimated point in AI-built apps. The database talks to the browser directly. If RLS is not active on a table, anyone holding this public key can query all rows of all users — bypassing the login entirely, without even using the app.

The sensible response: for every table, verify that RLS is enabled and that each policy is bound to the user's identity (typically auth.uid() = user_id). That is exactly what our deep scan checks inside the repository.