The test question 'if a stranger calls every table directly with the anon key, what do they get?' is the clearest way to frame this, because it moves the focus from hiding the key to what RLS actually allows. Noting that the newer sb_publishable_ and sb_secret_ formats exist alongside the legacy JWT keys is helpful too. The warning not to paste a possible service_role key into a third-party decoder is easy to miss and worth the space.
Thanks. That reframe is the whole point: the anon key is meant to be public, so the real question is what RLS lets it do. Quick habit: after every new table, curl it with only the anon key while logged out. If rows come back, RLS is off or too loose.
StackShortlist
Proof Over Promises.
The test question 'if a stranger calls every table directly with the anon key, what do they get?' is the clearest way to frame this, because it moves the focus from hiding the key to what RLS actually allows. Noting that the newer sb_publishable_ and sb_secret_ formats exist alongside the legacy JWT keys is helpful too. The warning not to paste a possible service_role key into a third-party decoder is easy to miss and worth the space.