Step 1: find your project address and public key
In your Supabase dashboard, open the project's API settings. Copy the project URL and the anon or publishable key. Never use the service role or secret key for this test; it bypasses every rule and will make every table look open.
Step 2: ask a table for one row
In a terminal, replace the project address, the table name and the key, then run:
curl 'https://YOUR-PROJECT.supabase.co/rest/v1/bookings?select=*&limit=1' \
-H 'apikey: YOUR-PUBLIC-KEY'Step 3: read the answer
- An empty list [] means either row-level security hides every row from anonymous users, or the table has no rows yet. Check the table has data in the Table Editor before you count it as protected.
- A row of data means the table is public. Anyone with your app's address can read it.
- An error saying the relation does not exist means the table is not exposed through the API, or the name is wrong.
Repeat for every table
Apps grow tables quietly. Run the request for each one, or list the tables with row-level security off using the SQL in our guide on whether Lovable is secure. LeakScan's anonymous data probe runs this kind of request for you.
Common questions
An empty list came back. Am I safe?
Only if the table has rows. If it does and nothing came back, anonymous reads are blocked. Also check what a signed-in user can read: a policy that allows any authenticated user lets every customer see every other customer's rows.