Row Level Security misconfiguration

One anonymous curl decides whether your Supabase table is actually protected

Supabase's dashboard shield reports whether row level security is switched on, not whether any policy filters a row, and the only thing that separates those two states is a request sent with the public anon key.