AskVibeMarked as helpful by the asker
Both are partly right.
The anon/publishable key is meant to be public. Every Supabase frontend ships it, moving it to an env var doesn't hide it (Vite bakes VITE_ vars into the bundle). Lovable is right about that.
But your friend is right to worry, because that key lets anyone call your database as an anonymous user. The only thing between that key and your patient data is Row Level Security.
Do this today:
- Dashboard → Table Editor: every table must show RLS enabled. "Not all" is the problem.
- For each table, check the policies. Things like
using (true)for select on a table with patient data = public. - Test it: log out, open the console, run
await supabase.from('appointments').select('*'). You should get[]. - Run Supabase's Security Advisor (Advisors → Security), it flags tables without RLS.
The service_role key is the one that must never be in the frontend. Search your built JS for service_role to be sure.
2 tables had no RLS, one of them was appointments. Turned it on and added policies, logged out test gives [] now. Feeling a bit sick honestly. mariam_k · edited
Good that you found it now. Consider checking the Supabase logs for unexpected reads in the last weeks, and depending on your country you may have a reporting duty for health data. mira_dev · edited
Excellent answer, nothing to add except: repeat step 3 every time you add a table. lena_ops · edited