Question 1

Is the Supabase anon key safe to expose?

Accepted Answer

Yes. The anon (or publishable) key is meant to be in your site's code. It is only safe if Row Level Security protects every table, view, function and storage bucket, because anyone can use it to talk to your database.

Question 2

How do I check if my Supabase tables are readable by anyone?

Accepted Answer

Ask your own database for rows using only the public anon key, the way a visitor's browser does. If rows come back from a table that should be private, Row Level Security is off or a policy is too loose.

Question 3

Is my Lovable app secure?

Accepted Answer

It can be, but apps from Lovable and other AI builders often ship with the same few holes: database tables anyone can read, secret keys in the browser, backend functions that don't check who's calling, and limits enforced only in the frontend. Check for those before you share the link.

Question 4

Does verify_jwt protect my Supabase edge functions?

Accepted Answer

No, not on its own. The public anon key is a valid JWT, so verify_jwt lets through anyone who copies it from your site. The function itself must check who the user is, and whether they may act on what they asked for.

Question 5

Which environment variables end up in my app's browser code?

Accepted Answer

Any variable whose name starts with your framework's public prefix: VITE_ in Vite (Lovable, Bolt), NEXT_PUBLIC_ in Next.js, REACT_APP_ in Create React App, EXPO_PUBLIC_ in Expo, PUBLIC_ in SvelteKit and Astro. Those are copied into the JavaScript every visitor downloads.

Question 6

Should I turn on email confirmation in Supabase?

Accepted Answer

For most apps, yes. Without it, anyone can sign up with any email address, including one they don't own, and gets a signed-in session straight away that your database rules treat as a real user.

Question 7

Can users change their own plan or credits in my Supabase app?

Accepted Answer

Often, yes. If your profiles table lets users update their own row and the policy doesn't limit which columns, a signed-in user can set their own plan, credits or role through the API, without paying.