Data shows in the editor and the live site is empty

This is the single most dangerous pattern in AI-built apps, and it has two opposite failure modes: tables locked so hard the app sees nothing, or tables open so wide that anyone can read every row. Audits of these projects keep finding the second one. Check yours today.

What is actually happening

The editor talks to your database with a privileged key. The browser uses the public key, and the public key is only allowed to do what your access rules say. No rule means no rows — the query succeeds and returns an empty list.

An empty list is not an error, so nothing is logged and nothing turns red. That is why people lose days on this.

The dangerous version of the same bug

The usual quick fix found in forums is a rule that allows everything to everyone. Now the app works and every visitor can read, and sometimes write, every row in the table.

Ask yourself what a curious visitor could read with your public key and a browser console. If the answer includes other people's data, stop and fix it now.

Checking it honestly in one minute

Open your live site in a private window, signed out, and open the network tab. Look at what the data request returns.

Test as a second signed-in user too. Many apps leak between users while looking correct to their owner.

What a correct setup looks like

Security on for every table. Public tables readable by anyone. Private tables readable and writable only where the row's owner matches the signed-in user. Anything sensitive done in a server route with the privileged key, never in the browser.

New tables added later start unprotected again. Check after every change.