Tables your app never queries
The ones nobody reviews, carrying whatever permissions they were made with.
Where they come from
A feature you abandoned. A table your AI tool created while trying something. An import you ran once. They stay in the schema, reachable through the API, with whatever permissions they had on the day they were made.
Because nothing queries them, nothing ever draws attention to them.
What to do
Decide, per table: still needed, or not. Drop the ones that are not. For the ones that are needed but should not be reachable from a browser, revoke API access:
REVOKE ALL ON public."old_leads" FROM anon;Then confirm the remaining ones have RLS enabled with a policy, same as everything else.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site