Security: Supabase Realtime subscription receives all row changes including drafts

[anshul23102]

Security Bug: Realtime Subscription Leaks Draft and Soft-Deleted Model Data

Description

The client-side Supabase Realtime subscription listens for all
postgres_changes on the models table without a row-level filter predicate.
Every connected browser receives the full payload of every INSERT, UPDATE, and
DELETE event, including rows in draft status or marked as soft-deleted
(e.g., status = 'draft' or deleted_at IS NOT NULL). Unpublished model
entries with pricing, benchmark data, or API keys submitted by contributors
awaiting review are broadcast to all connected clients.

Steps to Reproduce

1. Open the AIAtlas dashboard in a browser and subscribe to Realtime updates.
2. In another session (admin), create a draft model entry.
3. Observe the Realtime event arrives in the first browser's subscription
   with the full draft record, including any unpublished fields.

Root Cause

The Supabase channel().on('postgres_changes', ...) subscription is called
without a filter argument, which causes Supabase to send all changes.

Impact

Pending/draft model submissions (which may contain proprietorial pricing data
or early-access API keys) are broadcast to all connected users before review.

Proposed Fix

Add a filter to receive only published, non-deleted records:

supabase
  .channel("public:ai_models")
  .on(
    "postgres_changes",
    {
      event: "*",
      schema: "public",
      table: "ai_models",
      filter: "status=eq.published",  // Only published entries
    },
    (payload) => handleModelUpdate(payload)
  )
  .subscribe();

[anshul23102]

@AditthyaSS Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim