Glossary
Anon key
The public browser key. Safe to publish, useless without rules behind it.
What it means
The anon key is the public key your app ships to the browser so it can talk to your backend. It is meant to be visible. Seeing it in your bundle is not a finding.
The mistake is assuming it protects anything. It identifies the project, not the person. Everything it can reach is decided by the row rules behind it. If a table has no rules, the anon key reads that table, and so can anyone who opens your app and copies the key.
A check from outside can take the published key and ask your tables whether they answer. When they do, that is finding O8, with the table name as evidence. Whether the rules that should be there are correct is a separate question that no URL can settle.
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026