The publishable key is public by design — what you can reach is decided by row-level security against your signed-in identity.