TL;DR. The Exposed schemas list in Supabase decides which schemas the Data API serves to anyone holding your public key. The default is public and graphql_public . Every table, view and function in a schema on that list needs its own grants and RLS, so each extra schema is more surface to defend. Keep the list short and check it first.

I built a free Supabase security checker and the Exposed schemas list is one of the first things it reads. When someone asks me how secure their Supabase project is, this setting is where I start.

What does "exposed" mean in Supabase?

Supabase serves your database over REST with PostgREST. PostgREST only answers for the schemas in its db_schema list. You edit it in the Dashboard under Project Settings → Data API → Exposed schemas. On the project config I looked at, the value was public,graphql_public , and the Supabase custom schemas guide says public is exposed by default. A request for a schema outside the list gets refused.…