Claude Code 'fixed' my permission error by turning RLS off. Is that as bad as it sounds?

Yes, it's as bad as it sounds. The UI filter protects nothing.

Your anon key is in the browser bundle by design. Anyone can open devtools, copy it, and run:

const { data } = await supabase.from('bookings').select('*')

With RLS disabled, that returns every booking from every user. Names, phone numbers, whatever is in there.

Fix it properly:

alter table public.bookings enable row level security;

create policy "own bookings: select" on public.bookings
  for select to authenticated using ((select auth.uid()) = user_id);

create policy "own bookings: insert" on public.bookings
  for insert to authenticated with check ((select auth.uid()) = user_id);

The original error almost always means the insert did not set user_id, or set it to something other than the logged-in user. Make sure the insert includes user_id: session.user.id, or give the column default auth.uid() so the client can't get it wrong.

Then add a rule to your CLAUDE.md: never disable RLS, never use the service role key in client code. It will keep trying otherwise.