Security
Your database is open to the whole world
Press F12, open the Network tab and refresh. Find the request to your database address, and copy the apikey line from the headers too. Paste the address with the key into a private browsing window, without logging in. See rows of real data? The door is open.
Without the key you'll always get an error, even when the database is open, and you'll conclude you're protected. This is the step everyone skips.

