Findings
Low
Anonymous role granted access to realtime.subscription
- Affected:
- realtime.subscription
- Category:
- Permissions
- Confidence:
- medium
- First detected:
- 2026-08-12 11:04Z
- Last verified:
- 2026-08-16 09:41Z
Summary
System/managed schema has anon access, which is usually expected.
Why this matters
Anyone with the publishable API key could potentially access this relation without signing in, depending on RLS.
Evidence
- Role
- anon
- Privileges
- SELECT, INSERT
- RLS Enabled
- false
- Managed
- true
Facts above were derived by the scanner from database metadata. No model output is involved in the verdict.
Technical details
Supabase manages this schema. Modifying grants here may break internal platform features.
Attack path
internet → anon → rest → realtime.subscription
recommended remediation
Unlock the full security analysis
Buy full analysisReview anonymous privileges on realtime.subscription.
Current
-- Current state involves table grants and RLS status.
Proposed
-- No immediate action prescribed.
Expected security effect
- Modifying this could break legitimate public access or Supabase features.
Compatibility risk
high
Any public surface reading this relation without a session will break.
DBX never applies SQL to your database.