Tables without Row Level Security

Row Level Security is access control inside the database itself: policies decide per row who may read or change it. If RLS is not enabled on a table, there is simply no restriction for that table.

The underlying misconception is common: the login looks secure, so the app feels secure. But the login only governs who sees the interface. The database talks to the browser directly — and without RLS anyone with the public anon key can query all rows of all users, straight past the login.

We report this from your migration files: if a table is created without RLS ever being enabled for it, it shows up here. Fix: enable RLS for every table and add at least one policy binding access to the signed-in user.