Is Your App’s Data Exposed?

THE THREE CHECKS Open your app, press Cmd+Option+I (Mac) or F12 (Windows), go to Network, and click a request to your database. Copy the URL, the apikey header and the authorization header into the commands below, replacing the ALL_CAPS parts. 1. Can a logged-in user read everyone? Remove the id filter from the URL and run it: curl 'YOUR_PROJECT_URL/rest/v1/YOUR_TABLE?select=*' \ -H 'apikey: YOUR_PUBLIC_KEY' \ -H 'authorization: Bearer YOUR_LOGIN_TOKEN' If other users' rows come back, the table has no ownership rule. 2. Does it work with no login at all? Same request, authorization header removed: curl 'YOUR_PROJECT_URL/rest/v1/YOUR_TABLE?select=*' \ -H 'apikey: YOUR_PUBLIC_KEY' If rows come back, anyone on the internet can read your table. 3. Can a user change something they shouldn't? Try to update your own row's plan (or credits, or role): curl -X PATCH 'YOUR_PROJECT_URL/rest/v1/YOUR_TABLE?id=eq.YOUR_USER_ID' \ -H 'apikey: YOUR_PUBLIC_KEY' \ -H 'authorization: Bearer YOUR_LOGIN_TOKEN' \ -H 'Content-Type: application/json' \ -d '{"plan":"premium"}' If it says yes, your users can give themselves premium for free. THE RULES FROM THE VIDEO (Supabase example) This is the exact SQL I ran, for a table called profiles with id, email and plan columns. Change the table and column names to match yours. If you're on Firebase or your own backend, the rules look different; use this as the description of what you need. alter table public.profiles enable row level security; create policy "read own profile" on public.profiles for select to authenticated using (auth.uid() = id); create policy "update own profile" on public.profiles for update to authenticated using (auth.uid() = id) with check (auth.uid() = id); revoke all on public.profiles from anon; revoke update on public.profiles from authenticated; grant update (email) on public.profiles to authenticated; Line by line: turn rules on; logged-in users read only their own row; they update only their own row; visitors with no login get nothing; and the only column a user can edit is email, so plan stays out of reach. THE FULL CHECKLIST This is one check of 20 in my guide, Don't Get Hacked: The Pre-Launch Security Checklist: https://stan.store/andikany/p/launch-... SOCIAL MEDIA LinkedIn:   / andika-yudhatrisna-97172a229   Instagram:   / andikany   SOURCES (Lovable, 2025) Lovable's security flaw, CVE-2025-48757, found by Matt Palmer: 170 of 1,645 apps had missing or broken row level security. https://www.superblocks.com/blog/lova... https://cybersecuritynews.com/lovable...