Supabase default settings silently granted anon users TRUNCATE rights on all tables

A developer discovered that Supabase's default schema configuration had automatically granted the 'anon' and 'authenticated' roles TRUNCATE and TRIGGER privileges on 96 and 109 tables respectively, without any action on their part. The root cause was a platform-level default ACL entry that applies these privileges to every new table created in the public schema. Unlike SELECT, INSERT, UPDATE, and DELETE, TRUNCATE is not governed by PostgreSQL's row-level security, meaning RLS policies offer no protection against it. The developer's own pre-commit migration checker failed to catch the issue because it only validated what was explicitly written, not what the platform silently added by default. A repair migration was written to revoke the privileges, though a follow-up check revealed the fix had missed seven views due to a filter that excluded non-standard relation types.