Is your Supabase data public? Try it.
Both buttons run the same query with the public key and no session — exactly what a stranger can do from a browser console.
What differs
| Check | Open | Fixed |
|---|---|---|
| Row-level security actually protecting rows | ✗ | ✓ |
| Policies per user | ✗ | ✓ |
| Service key kept off the client | ✗ | ✓ |
| Rate limit on expensive endpoints | ✗ | ✓ |
| Server-side validation | ✗ | ✓ |
Rows 1–2 are what this demo shows live. Rows 3–5 are the rest of what I check in a real audit.