VibeGuard Security Audit: demo-ai-store.lovable.app

Table	Record Count	Vulnerability	Sensitive Fields
profiles	142 rows	Missing RLS	emailphone
orders	89 rows	Missing RLS	emailtotal_price

⚡ Automated SQL Remediation

Execute the SQL policies below directly in your Supabase SQL Editor to enforce Row-Level Security and prevent unauthorized public reading.

Row-Level Security Patch for public.profiles

-- 1. Enable Row-Level Security on 'profiles'
ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;

-- 2. Remove default public permissions
REVOKE ALL ON public.profiles FROM anon;
GRANT SELECT, INSERT, UPDATE, DELETE ON public.profiles TO authenticated;

-- 3. Restrict row reading to authenticated owner
DROP POLICY IF EXISTS "Users can only read own profiles" ON public.profiles;
CREATE POLICY "Users can only read own profiles"
ON public.profiles
FOR SELECT
TO authenticated
USING (auth.uid() = id);

-- 4. Restrict row updates to authenticated owner
DROP POLICY IF EXISTS "Users can only update own profiles" ON public.profiles;
CREATE POLICY "Users can only update own profiles"
ON public.profiles
FOR UPDATE
TO authenticated
USING (auth.uid() = id);

Row-Level Security Patch for public.orders

-- 1. Enable Row-Level Security on 'orders'
ALTER TABLE public.orders ENABLE ROW LEVEL SECURITY;

-- 2. Remove default public permissions
REVOKE ALL ON public.orders FROM anon;
GRANT SELECT, INSERT, UPDATE, DELETE ON public.orders TO authenticated;

-- 3. Restrict row reading to authenticated owner
DROP POLICY IF EXISTS "Users can only read own orders" ON public.orders;
CREATE POLICY "Users can only read own orders"
ON public.orders
FOR SELECT
TO authenticated
USING (auth.uid() = id);

-- 4. Restrict row updates to authenticated owner
DROP POLICY IF EXISTS "Users can only update own orders" ON public.orders;
CREATE POLICY "Users can only update own orders"
ON public.orders
FOR UPDATE
TO authenticated
USING (auth.uid() = id);

🛡️ VibeGuard Security Audit

Exposed Database Endpoints

⚡ Automated SQL Remediation