I built this after finding a service_role key in the client bundle of one of my own side projects. It had been live for weeks. That key bypasses RLS completely, so anyone who opened the site could have read every row of every table.
Source: [Hacker News](https://www.sentris.dev/index)