https://shipreadyai.dev/learn/findings/o8-rpc-functions

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Functions callable by name from the public schema

The public schema names {total} functions callable by name: {functions}. Whether each checks authorization needs a code review. ShipReady lists the names and never calls them, which is why backend rules stay on the not verified list.

## Why AI-built apps get this

AI builders create tables in seconds and leave the access rules for later. The browser key is published in your app by design, so a table with no rule behind it answers anyone who copies that key. This is CVE-2025-48757 across 170 apps, and the Moltbook exposure, in one sentence.

## Evidence line

table profiles answered the published browser key with 42 rows

## The fix

Open each function and confirm it checks the caller before it does anything, or take it out of the public schema.

## Prompt

Review every function exposed in the public schema, confirm each one checks the caller, and move the rest out of the public schema.