Supabase
Security & compliance
Schemas beyond public exposed through the data API
Part of the Auth hardening & exposure config check · fix arrives as a guide
What it is
Schemas beyond public are exposed through the Data API.
Why it matters
Those schemas usually hold the things deliberately kept out of the API — internal tables, audit records, staging data — and exposing them makes all of it reachable with an anon or authenticated key, subject only to RLS that may never have been written for them.
How to fix it
Restrict the exposed schemas to public in the API settings. Where another schema genuinely needs exposure, enable RLS on every table in it first and write policies before exposing it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.