Your table names are in your JavaScript

If the browser queries your database directly, the query has to name the table. Minification renames your variables, not your table names — they are string literals sent to the server.

Any visitor can open developer tools and read the list. There is no configuration that changes this.

Make the names harmless. A visible table name matters only if the table answers to an anonymous request, so the fix is Row Level Security on every table, without exception.

For tables that should never be reachable from a browser at all — audit logs, internal notes, anything administrative — revoke access from the anon role entirely and move those queries behind a server route:

REVOKE ALL ON public."admin_notes" FROM anon;

A table called api_keys invites more attention than one called tokens_v2. This is not security and should never be relied on, but if you are naming a new table anyway, there is no reason to advertise.