Profiles table missing RLS policy, all user emails readable via anon Supabase key

[anshul23102]

Bug Description

The profiles table in Supabase has no Row Level Security policy scoping reads to the authenticated user's own row. Using the publicly exposed VITE_SUPABASE_ANON_KEY, any visitor can retrieve the email address and profile data of every registered user.

Steps to Reproduce

1. Extract VITE_SUPABASE_ANON_KEY from the browser bundle.
2. Run:

curl 'https://<project>.supabase.co/rest/v1/profiles?select=id,email' \
  -H 'apikey: <anon_key>' -H 'Authorization: Bearer <anon_key>'

3. Observe: all profile records returned without authentication.

Root Cause

RLS is not enabled on profiles, or the policy is missing the USING clause that restricts reads to the owner:

-- missing policy:
CREATE POLICY "users view own profile"
  ON profiles FOR SELECT
  USING (auth.uid() = id);

Impact

Mass PII exposure: names, emails, and profile metadata of all registered users harvested without any authentication.

Proposed Fix

ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;
CREATE POLICY "owner_read" ON profiles
  FOR SELECT USING (auth.uid() = id);
CREATE POLICY "owner_update" ON profiles
  FOR UPDATE USING (auth.uid() = id);

[anshul23102]

@durdana3105 Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim