18.8% of public Supabase repos left a table readable by the anon key

A developer replayed the migration history of 1,000 public Supabase repos into local databases and checked every table. 18.8% had a table without RLS readable by the anon key at some point, and 10.9% still do at their latest commit; the median open exposure lasted 47 days.

• 18.8% of 777 repos had a fully readable table in at least one commit
• 10.9% of 393 repos still expose one at their latest commit
• 67% of closed exposures lasted over a day, 37% over a week
• Only 39% of latest commits replay cleanly on a fresh database