Is your database public? How to check in two minutes.

Supabase and Firebase are great for building fast with AI. But both share the same trap: by default, it's easy to leave your database readable by anyone on the internet — not just your app.

The missing protection is called row-level security (RLS). Without it, the rules that decide who can read what simply don't exist, and your app's nice interface protects nothing.

The two-minute test

Open your app in a browser, open developer tools, and watch the network tab as the page loads. If you see data arriving straight from the database with no permission check, every visitor sees it too. They just copy the request.

What to do

• Turn on row-level security for every table.
• Write explicit policies: each user can only see their own data.
• Never trust what the interface hides — the rule has to live on the server.

If this sounds scary, that's because it matters. If you're not sure your database is locked down, we'll check it for you — for free.