I bet supabase also have a lot of naive users who haven't enabled RLS in their postgres instances (last I checked, not enabled by default), but are nevertheless sharing api keys client side in their apps (https://supabase.com/docs/reference/javascript/initializing).

Supabase support's defense is "well, if you read the manual you'll understand how to set this up properly", but that's not how bootcamp developers tend to work.

I spent 10 minutes seeing if I could convince google or kagi to search for sites like these, but unfortunately js isn't searchable in either.