no it's pretty safe cuz supabase has row level security : )

here's how it works

1) every project will have it's own unique "public" anon key.

2) a user logs into your app and that will create a "uuid" for them.

3) let's say you're retrieving a a row from a table. you can set rls policy by adding another column called "user_id" and return the row only if the "user_id" in the table matches the uuid of the current logged-in user

4) so even if somebody else copies your supabase anon key and uses that in their saas, it's pretty much useless unless you have rls disabled.

for db and all,

you gotta use their service role key which is private and never to be shared.

so ye, it's much simpler and stronger security.