Supabase: RLS, which flows silently

Live PostgreSQL 16, configured exactly like in Supabase (roles anon/authenticated, auth.uid(), request.jwt.claims as in PostgREST). Three versions of the policy on live buttons: silent leak (RLS not enabled), silent zero (policy only for authenticated), and fixed version. Each response shows the SQL that was actually executed.

Custom working stand of GuardLabs (not a client order).
Live demo: guardlabs.online/demo/supabase-rls/