Critical: How can we use rest apis when the key is public? Or Supabase at all

[erbteilung]

I just found out that the rest api keys are findable in the browser:

So how should be use rest apis with the key being public?
Not only update and insert are a problem even the selects when you deal with sensitive data.

In another thread about supabase problems with the plugin (rsl) you tell us to use the rest-api untill you change the plugin. But how should we use the supabase rest api when the key is public? Then everybody can alter the database as they want to.

With supabase auth you can restrict insert and update to authenticated users but need to activate select to everyone. What? So everyone can read everything?

Maybe I am wrong but it seams not possible to use weweb for sentive data at all?

[Alexis]

Help with Supabase RLS policies

Supabase provide two separate keys. One is private, the other one is public. In our supabase plugin we ask for both. The private one allow to connect to your supabase as an administrator (like accessing to the supabase back office), it’s used in the editor to analyse your instance and improve the user experience, it make us able to display your table list for example. The private key is never embed inside the published website of course. The public one is used to connect to your supabase as a…