I received an email regarding excessive cached egress usage - the number of monthly active users is very small and the code running the website/the database schema hasn't changed for some extended time (and this hasn't previously been an issue, even when the MAU was higher nearer 'peak' times (annual event website)).
How should I attempt to track down the cause? (I found a lot of realtime subscriptions using the "Query Performance" tracker - I'm unsure if these were entries generated during real use, but I was able to change the website to ensure that only signed-in users generate subscription events, which I suspect will solve that issue.
However, the usage remained high in the days since and now I was notified that the period to correct this issue has been sharply shortened (from a month to 3 days).
I am hosting the website using my database on Vercel, and when I found unexpected usage there, toggling various firewall options to deny bots/LLM agents appears to have reduced the problem, but that was more than a month ago and so I'm unsure what I should consider specifically regarding Supabase.