AskVibeMarked as helpful by the asker
Both are right, depending on one thing: RLS. With Row Level Security on every table, the browser talking to Supabase directly is the intended design; the database is the backend. Without RLS, your friend is right and everyone can read everything.
You need a server only for things that must stay secret from the browser: third-party API keys, payments, sending email. For plain CRUD on your own tables, RLS is the backend.
So the anon key being visible in the browser is normal? noor_builds · edited
Yes. It's public by design, like the front door of a shop. RLS is the person deciding who gets into the back. mira_dev · edited