lowHeuristic matchwarnSupabase / BaaS
Public Supabase client key detected — RLS policy verification recommended
Found 1 Supabase project URL(s) and 0 public anon/publishable key(s). These are publishable by design; whether your tables are open depends on RLS, which ShipGuard does not test. Open tables are a possibility to verify, not a confirmed finding.
Use the free RLS SQL generator at /tools/rls-generator to draft owner policies, then test each table with the anon key and two test users.
Heuristic: detected by pattern-matching publicly served JavaScript. ShipGuard did not call your Supabase or Firebase APIs with this key and did not test whether any table or collection is readable.
Locations
- https://aiqualityhq.com/ → https://ykpiumpcqlgqzgslxicn.supabase.co
Copy-paste fix prompt
@codebase Security fix. My Supabase project URL and anon/publishable key are in my client bundle (that is normal), so data safety depends entirely on Row Level Security. For every table in the public schema: enable RLS, add explicit owner policies (e.g. `auth.uid() = user_id`), revoke anon privileges on tables that should not be public, keep user uploads in private storage buckets, and write a test that queries each table with the anon key and confirms no unexpected rows come back. Make the minimal change, show the diff per file before applying, and add a short note in SECURITY.md describing the fix.
Reference: ShipGuard RLS SQL generatorSupabase: Row Level Security