ShipGuardScan a site

Supabase PostgREST Schema Exposure: What It Means

Updated 2026-10-17

PostgREST can publish an OpenAPI description of every table, view and function the requesting role can see. With the anon key, that can be a map of your data model.

What it reveals

Table and column names, RPC function names and parameters. It does not by itself return rows, and it does not prove RLS is off.

Reduce it

Revoke anon privileges on tables that only signed-in users need, move internal tables and functions to a schema that is not exposed through the API, and make sure every exposed table has RLS.

revoke all on table public.internal_events from anon;
create schema if not exists private;
alter table public.internal_events set schema private;

Checklist

  • Anon grants minimized
  • Internal objects in a private schema
  • RLS on all exposed tables
  • RPC functions use security invoker unless definer is required

Copy-paste fix prompt

List all tables, views and functions in my exposed Supabase schemas with their anon/authenticated grants. Suggest which to revoke from anon, which to move to a private schema, and add RLS where missing.

FAQ

Is a visible schema a vulnerability?

It is reconnaissance value for an attacker rather than a breach. Combined with missing RLS it becomes serious.

Will revoking anon grants break my app?

Only for features used before sign-in. Test logged-out flows after changing grants.

Check your deployed app in ~25 seconds

Free passive scan: leaked keys, Supabase exposure, public config files and headers.

Run a free scan

Related