the "anon key in the frontend is fine" thing, and what actually isn't fine
the anon / publishable key being in your frontend is expected, that's how supabase works. the problems start when:
- RLS is off on a table, so the anon key can read everything
- RLS is on but the policy is `using (true)`, same result
- the service_role key ends up in the client bundle instead of the anon one
- storage buckets are public when they shouldn't be
the first three you can check yourself: open your deployed app, search the bundle for `service_role`, then try a plain REST select on your tables with the anon key and no session.
i'm building a scanner for AI-built apps (clarseal.com, disclosure: mine) that checks the bundle for leaked keys today. table checks currently need you to paste your anon key on a paid plan, and i'm working on testing the key it finds in the bundle automatically, only on apps you confirm you own.
curious how people here test their policies before launch. pgTAP? manual curl? nothing?
