Guide Supabase
Can other people see my users' emails and data? (Lovable, Bolt and Supabase)
Short answer
They can if your users table (a table like profiles) lets everyone read it. In a Lovable or Bolt app the browser talks to the database directly, so anyone can send the same request your app sends. What stops them is an access rule on each table (an RLS policy) that lets each person read only their own row.
The quick test
Make two accounts. Logged in as the second account, try to open the first account's profile or orders. Then sign out and try again.
If you see anything that belongs to someone else, fix the rule for that table so it checks the owner (for example (select auth.uid()) = user_id), then repeat the test for reading, adding, changing and deleting.
Need to show a public name or avatar?
Put only those fields in a separate public view or table and keep emails, plans and payment IDs private.
Before you launch
Policy examples you can copy: Supabase RLS policy examples. For a quick outside look at your site, use our free check for exposed keys and missing security headers.
Where we can help
Free instant check: paste your URL at patchandship.com/check.html to scan your homepage's JavaScript for secret keys and security headers (no signup, nothing stored). Paid, fixed price per app: Database Check, $49; Security Fix, $149 (every critical issue on our checklist fixed within 48 hours of working access); Fix & Deploy, $249. Otherwise a full refund if you ask within 14 days of purchase (Refund Policy). AI agents run the checks and a human engineer approves every change. Not a penetration test or a security guarantee.
FAQ
Can someone really query my users from the browser console?
Yes, if the table's access rules allow it. The browser already has your project URL and public key, so the rules on each table are what protect the data.
Should my profiles table be public?
Only the fields you mean to show, such as a display name or avatar. Keep emails, plans and payment IDs in a private table.
Which operations should I test?
Reading, adding, changing and deleting, both as a second account and signed out.