lowHeuristic matchwarnSupabase / BaaS
Public Supabase client key detected — RLS policy verification recommended
Found 1 Supabase project URL(s) and 0 public anon/publishable key(s). These are publishable by design; whether your tables are open depends on RLS, which ShipGuard does not test. Open tables are a possibility to verify, not a confirmed finding.
Use the free RLS SQL generator at /tools/rls-generator to draft owner policies, then test each table with the anon key and two test users.
Heuristic: detected by pattern-matching publicly served JavaScript. ShipGuard did not call your Supabase or Firebase APIs with this key and did not test whether any table or collection is readable.
Locations
- https://www.foundrlist.com/ → https://iftfmhvwcazkbvzbzobc.supabase.co
Copy-paste fix prompt
Security fix for this v0 / Next.js app. My Supabase project URL and anon/publishable key are in my client bundle (that is normal), so data safety depends entirely on Row Level Security. For every table in the public schema: enable RLS, add explicit owner policies (e.g. `auth.uid() = user_id`), revoke anon privileges on tables that should not be public, keep user uploads in private storage buckets, and write a test that queries each table with the anon key and confirms no unexpected rows come back. Use route handlers or server actions for privileged work, keep secrets in non-NEXT_PUBLIC_ env vars behind `import "server-only"`, and set headers in next.config.
Reference: ShipGuard RLS SQL generatorSupabase: Row Level Security