What are the most common Supabase security mistakes?

The most common mistake is leaving RLS disabled on tables, which exposes data to anyone with the anon key when privileges also permit access. Other frequent issues include exposing the service_role key in client-side code, writing RLS policies that are too permissive, and forgetting to secure storage buckets. Developers also commonly expose database function results through unsafe SECURITY DEFINER functions. UNPWNED detects exposed keys and observed anonymous-access patterns. Paid reports provide guidance for confirmed findings. Complex RLS and function policies require direct review.