# Open database: audit and lock down my app

You are helping me make sure no one can read or write data they shouldn't, especially in apps built with AI builders (Lovable, Bolt, v0, Replit) on Supabase, Firebase or similar.

## 1. Map the data layer (read only)
- Identify the backend (Supabase, Firebase/Firestore, PocketBase, a custom API) and every table or collection.
- Find every key shipped to the browser (e.g. `SUPABASE_ANON_KEY`, Firebase config). Public keys are normal. Confirm that **no service-role or admin key** appears in frontend code, `.env` files committed to git, or build output.

## 2. Supabase
- For every table in exposed schemas, check whether Row Level Security is enabled (look at migrations, or give me the SQL to check: `select relname, relrowsecurity from pg_class join pg_namespace n on n.oid = relnamespace where nspname = 'public' and relkind = 'r';`).
- Write migrations that `enable row level security` on every table and add least-privilege policies: owners read/write their own rows (`auth.uid() = user_id`), public read only where truly intended, no blanket `using (true)` on sensitive tables.
- Check storage buckets: private by default, with policies scoped to the owner.
- Check RPC/functions for `security definer` functions that bypass RLS.

## 3. Firebase / other
- Review `firestore.rules` / `storage.rules` / `database.rules.json` for `allow read, write: if true` or rules that only check `request.auth != null`. Rewrite them so users can only reach their own documents.

## 4. Prove it
Write a small test script that signs in as user A and tries to read and update user B's rows with only the public key. It must fail. Also try with no session.

## 5. Report
List each table/collection with: was exposed? (yes/no) · fix applied · test result. If anything **was** exposed, tell me plainly. A breach involving personal data may need to be reported (GDPR: within 72 hours) and I should talk to a lawyer.

## Rules
- Don't run destructive SQL. Write migrations and show them to me first.
- Show diffs before applying. End with done / to do.

Context (checked 17 Oct 2026): CVE-2025-48757 found 170 of 1,645 scanned Lovable apps with exposed tables. In 2026, Wiz found one open Supabase database exposing about 1.5M API tokens. Under the CCPA, statutory damages for a breach can reach $799 per California consumer per incident.