It would not be surprising if half of the pre-"vibe coding" mobile apps that use Supabase have the exact same security holes. This is really nothing new, it's inherent to RLS being just the technology that sounds incredibly convenient to beginners yet comes with the right footguns they are likely to miss, despite Supabase doing its best with warnings in the UI. I think SB is a cool company that means well, but RLS will never be reliable. It takes too much discipline to use safely and reliably on any meaningful project, and at that point it's simpler to just roll an API or a few serverless functions.