What it means

Your app's database (often Supabase or Firebase) answers requests without any authentication — anyone with the URL can read the tables, including whatever user data they contain.

Why it matters

This is a data breach waiting to be found. Art. 32 GDPR requires appropriate security; once someone reads the data, Art. 33 puts you on a 72-hour clock to notify the supervisory authority.

How to fix it

Enable Row Level Security (Supabase) or security rules (Firebase) and test that an unauthenticated request is rejected. Your builder's docs have a checklist — it's usually a 15-minute fix.