PocketBase collections are public until you set a rule

PocketBase controls access with five API rules per collection: List, View, Create, Update and Delete. Each one is either a filter expression, or blank.

Blank does not mean closed. Blank means **anyone**, with no authentication at all. That is the value a new collection starts with in the admin UI.

Open each collection in the admin UI, go to API Rules, and set them. For data that belongs to a user, the List and View rules usually look like this:

@request.auth.id != "" && user = @request.auth.id

For a collection that should never be read from the browser, set the rule to reject everything — the admin UI calls this "Set to admins only" — and reach it from a server route instead.

Open a private browser window, signed out, and request https://your-instance/api/collections/<name>/records. A closed collection returns 403. If you get a JSON list of records, the rule is still open.

Setting the List rule and forgetting View. List controls the collection endpoint; View controls fetching one record by id. A locked List with an open View still leaks every record to anyone who can guess or enumerate ids.