Lab results
Sensitive data publicly accessible
0023_sensitive_columns_exposedERROR
A table reachable through your API, with RLS off, has columns whose names suggest sensitive data: passwords, tokens, keys or ID numbers. It is the same open door as “Table publicly accessible”, with the worst things behind it.
Supabase’s Security Advisor shows this warning. Explained for people who built their app with AI. Last checked .
select c.table_name, c.column_name
from information_schema.columns c
join pg_tables t
on t.schemaname = c.table_schema and t.tablename = c.table_name
where c.table_schema = 'public'
and t.rowsecurity = false
and c.column_name ~* '(pass|token|secret|key|ssn|iban|card)';
- Line 7: A rough match on column names: each hit sits in an open table. Check what is really stored there.
Run it in your Supabase dashboard under SQL Editor. It only reads, it changes nothing.
Why AI-built apps get it
AI tools sometimes store API tokens, reset codes or even passwords in ordinary tables next to the user’s profile, then never turn RLS on.
The real fix
Enable RLS with owner-only policies. Then ask whether the column should exist at all: passwords belong in Supabase Auth only, and keys for other services belong in your server’s environment, not in a table.
Treatment
Fix it with your AI, then make sure it holds
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever you built with. It asks for the fix and for an explanation you can check.
Watch out: If secrets were in an open table, assume someone copied them. After the fix, rotate those keys and tokens at the service that issued them.
Your AI says it’s fixed. Is it?
The warning going away is not proof. In a Safety Scan I read your code and your database rules, prove every critical problem on your live app with two test accounts and check your fixes again for free within 30 days. From $149 for the first 10 customers, report within 2 business days.
Find every table in the public schema of my Supabase project that stores passwords, tokens, API keys, ID numbers or payment details. For each, tell me whether row level security is on, who can read it, and whether the data needs to be stored at all. In a new migration, enable RLS with owner-only policies, and propose how to move secrets out of the database (Supabase Auth for passwords, server environment variables for API keys). List every key I should rotate.
Signed
Often found together
Get your app triaged.
From $149 for the first 10 customers. Ready within 2 business days of complete access. If the Safety Scan finds no problem rated medium or worse, I refund the full price automatically.
Visiting hoursBook any time. I reply within one business day.