Can Supabase data be accessed without authentication?

Yes, if RLS is disabled or if RLS policies allow anonymous access, data can be accessed without authentication using only the project URL and anon key. The anon key is a JWT that corresponds to the anon role in PostgreSQL, and it is intended to be public. Any table without RLS enabled is fully readable and writable by anyone who has this key, which is typically exposed in client-side JavaScript. This is one of the most common misconfigurations in Supabase projects. UNPWNED performs bounded anonymous-access checks using public client configuration and reports confirmed exposure. Complete table coverage and policy correctness require Supabase-side review.