Is Supabase secure by default?

Supabase is not fully secure by default. When you create a new table, RLS is disabled, meaning the table is accessible to anyone with your project URL and anon key. The anon key is designed to be public and is embedded in client-side code, so it provides no protection on its own. Supabase relies on developers to explicitly enable RLS and write appropriate policies for each table. Storage buckets also default to private but require proper policies to enforce access control. UNPWNED performs bounded external anonymous-access checks using public client configuration and reports confirmed exposure. Complete table, bucket, and policy coverage requires Supabase-side review.