An HTTP 200 response does not by itself prove data exposure.
When a REST endpoint returns an empty JSON array, two different facts are easy to conflate:
- The table route is reachable.
- The current request can read rows.
The first is not evidence of the second.
A useful verification matrix exercises at least four paths: an anonymous request, an authenticated owner request, an authenticated non-owner request, and a privileged service path. Record the status, response shape, and row visibility separately for each path.
Repeat the matrix after every policy migration. A dashboard showing that RLS is enabled describes intended configuration; the deployed behavior is the evidence that matters.
Keep the test read-only. GET, HEAD, and OPTIONS are enough for an initial public-surface check. Do not paste a service-role key or private database credential into a public scanner.
RowShield provides a free public probe for a deployed Supabase URL and optional public anon key: https://rowshield.dev/audit
Treat its result as scoped evidence, not a guarantee. Private schemas, routes behind authentication, and business logic outside the observable public surface still require repository tests and review.