I scanned my own Supabase project and found 17 tables anyone could read with the anon key

I run two SaaS products on Supabase. I've been on the platform for over a year. I'd like to think I know what I'm doing. Then Supabase published the May 2026 update about tables in public no longer auto-exposing to the Data API. Two deadlines: May 30, 2026 — new behavior is the default for all new p