Security report

What it means

Any logged-in user can read every row in profiles, including other users' emails and phone numbers.

Why it matters

That's a data breach waiting to happen and may break GDPR obligations. We read 2,481 rows as a fresh test account.

How to fix

Enable Row Level Security and allow users to read only their own row.

alter table public.profiles enable row level security;

create policy "Users read own profile"
on public.profiles for select
to authenticated
using (auth.uid() = id);