The part people are ignoring is Supabase's culpability in this matter: https://github.com/orgs/supabase/discussions/4547

This was supposedly fixed on October 30, but there are reports floating around that for existing projects, the defaults still apply.

Lovable deserves some heat for using this, but this was a choice that was made by Supabase many years ago to support making it easier to onboard potential customers, a deliberate tradeoff of less onboarding pain for less security.

> I've realised that the supabaseKey needed for creating the client on the frontend also grants users access to the database by default.

I can't believe someone actually made this by design

While we’re at it, I was quite surprised to discover that Supabase leaks schema information through the `hint` field in error messages:

https://docs.postgrest.org/en/latest/references/errors.html

For example, if you try to access a table named "secret" that doesn’t exist, Supabase might return a hint saying, "Perhaps you meant the table 'public.super_secret'."

Thanks for volunteering that information, I guess.