Black-box API verification

One anonymous curl decides whether your Supabase table is actually protected

Supabase's dashboard shield reports whether row level security is switched on, not whether any policy filters a row, and the only thing that separates those two states is a request sent with the public anon key.