https://shipreadyai.dev/learn/findings/o8-tables-exposed

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Some database tables answer without anyone signing in

A request made with the browser key alone returned rows, which means the row rules on those tables let anonymous readers in.

## Why AI-built apps get this

AI builders create tables in seconds and leave the access rules for later. The browser key is published in your app by design, so a table with no rule behind it answers anyone who copies that key. This is CVE-2025-48757 across 170 apps, and the Moltbook exposure, in one sentence.

## Evidence line

table profiles answered the published browser key with 42 rows

## The fix

Turn on row level rules for each table listed and write a policy scoped to the signed in owner. Tables returning rows: {tables} of {total} readable.

## Prompt

These tables return rows to anyone with your public key: {tables}. Turn on row level security for each and add policies that only let the signed-in owner read their own rows.