# All the users

> I built a test app. I pulled the list of all its users in one second.

URL: https://iamcanturk.dev/en/shorts/butun-kullanicilar/
Pixel Shorts #12 · October 26, 2026 · for developers

---

**In short:** In Supabase, the publishable key being in the browser is normal; RLS is what protects the table. With RLS off, anyone with the key can read the whole table: enable RLS on every table and never write a policy that is just true.

The code worked fine. The database key was in the browser, but that's normal.


## What's in the video?
I built a test app. I pulled the list of all its users in one second. The code worked fine. The database key was in the browser, but that's normal. There are two keys. The publishable key can sit in the browser. The secret key, never. The real door is RLS. The assistant forgot to turn it on. It didn't only happen to me. A researcher scanned 1,645 projects built with Lovable. 170 of them were missing RLS. It became a CVE: CVE-2025-48757. According to Lovable, protecting the data is the app owner's job. Anyone who gets the key can read the whole table. Emails, phone numbers, orders. The fix: turn on RLS for every table. Everyone sees only their own rows. The policy is one line. Show the row if its owner is the logged-in user. One more trap. If you write just true in the policy, you open the door to everyone again. Log out and send the same request again. If data comes back, your door is open. Give the prompt on screen to your assistant, and save this video. Tomorrow: one sentence hidden in websites' headers. Ignore previous instructions.