November 5, 2026 at 5:01 PM
Fresh Supabase tables ship with RLS off by default.
Until you turn it on, anyone with the anon key can read the rows.
Short tip: abbilabs.xyz/tips/new-tab...
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #Lovable
Until you turn it on, anyone with the anon key can read the rows.
Short tip: abbilabs.xyz/tips/new-tab...
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #Lovable
November 8, 2026 at 8:35 PM
Fresh Supabase tables ship with RLS off by default.
Until you turn it on, anyone with the anon key can read the rows.
Short tip: abbilabs.xyz/tips/new-tab...
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #Lovable
Until you turn it on, anyone with the anon key can read the rows.
Short tip: abbilabs.xyz/tips/new-tab...
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #Lovable
RLS was a master of prose!
:)
:)
November 5, 2026 at 3:47 PM
RLS was a master of prose!
:)
:)
The cyber truck is getting canned, post a vehicle women actually like
November 8, 2026 at 2:14 AM
The cyber truck is getting canned, post a vehicle women actually like
is_admin on your profiles table + an "update own profile" policy = anyone signed in can make themselves admin.
RLS checks which row, not which column.
abbilabs.xyz/guides/supab...
#Supabase #RLS #vibecoding #AppSec #Postgres #webdev
RLS checks which row, not which column.
abbilabs.xyz/guides/supab...
#Supabase #RLS #vibecoding #AppSec #Postgres #webdev
November 10, 2026 at 1:45 AM
is_admin on your profiles table + an "update own profile" policy = anyone signed in can make themselves admin.
RLS checks which row, not which column.
abbilabs.xyz/guides/supab...
#Supabase #RLS #vibecoding #AppSec #Postgres #webdev
RLS checks which row, not which column.
abbilabs.xyz/guides/supab...
#Supabase #RLS #vibecoding #AppSec #Postgres #webdev
New Supabase table? RLS starts off. Anon key can read it until you enable RLS + owner policies. Check Table Editor / Security Advisor.
abbilabs.xyz/tips/new-tab...
#Supabase #RLS #vibecoding #AppSec #webdev #buildinpublic #PostgreSQL #SaaS #Cursor #Lovable #devtools
abbilabs.xyz/tips/new-tab...
#Supabase #RLS #vibecoding #AppSec #webdev #buildinpublic #PostgreSQL #SaaS #Cursor #Lovable #devtools
Abbi Labs — security monitoring for AI-built apps
Abbi Labs scans your Lovable, Bolt, v0, Cursor or Replit app from the outside for leaked keys, open Supabase tables and exposed files, weekly and on every deploy.
abbilabs.xyz
November 6, 2026 at 9:05 PM
New Supabase table? RLS starts off. Anon key can read it until you enable RLS + owner policies. Check Table Editor / Security Advisor.
abbilabs.xyz/tips/new-tab...
#Supabase #RLS #vibecoding #AppSec #webdev #buildinpublic #PostgreSQL #SaaS #Cursor #Lovable #devtools
abbilabs.xyz/tips/new-tab...
#Supabase #RLS #vibecoding #AppSec #webdev #buildinpublic #PostgreSQL #SaaS #Cursor #Lovable #devtools
SupabaseのRLSをONにしたら、次は「別のユーザー」で試そう | shingokumon #zenn
https://zenn.dev/shingokumon/articles/supabase-rls-other-user
https://zenn.dev/shingokumon/articles/supabase-rls-other-user
SupabaseのRLSをONにしたら、次は「別のユーザー」で試そう
zenn.dev
November 9, 2026 at 12:12 PM
SupabaseのRLSをONにしたら、次は「別のユーザー」で試そう | shingokumon #zenn
https://zenn.dev/shingokumon/articles/supabase-rls-other-user
https://zenn.dev/shingokumon/articles/supabase-rls-other-user
need to stop screwing around and download RLS career overhaul
I haven't modded games in a long time
I haven't modded games in a long time
November 10, 2026 at 1:40 AM
need to stop screwing around and download RLS career overhaul
I haven't modded games in a long time
I haven't modded games in a long time
RLS marked on, but the policy only says authenticated users can read? Every signed-in user can still pull every row.
How to spot that gap: abbilabs.xyz/guides/supab...
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #webdev
How to spot that gap: abbilabs.xyz/guides/supab...
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #webdev
November 7, 2026 at 8:35 PM
RLS marked on, but the policy only says authenticated users can read? Every signed-in user can still pull every row.
How to spot that gap: abbilabs.xyz/guides/supab...
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #webdev
How to spot that gap: abbilabs.xyz/guides/supab...
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #webdev
Common Supabase slip: RLS is on, but the policy only checks that someone is signed in.
That still lets user A read user B's rows. Owner column has to match auth.uid().
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #vibecoding #webdev
That still lets user A read user B's rows. Owner column has to match auth.uid().
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #vibecoding #webdev
November 7, 2026 at 6:35 AM
Common Supabase slip: RLS is on, but the policy only checks that someone is signed in.
That still lets user A read user B's rows. Owner column has to match auth.uid().
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #vibecoding #webdev
That still lets user A read user B's rows. Owner column has to match auth.uid().
#Supabase #SaaS #buildinpublic #AI #Lovable #AppSec #vibecoding #webdev
Before a private Supabase table goes live, do you try updating a row as a second user and rewriting user_id?
That's the WITH CHECK hole that SELECT tests miss.
Curious what your pre-ship habit is.
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #AI
That's the WITH CHECK hole that SELECT tests miss.
Curious what your pre-ship habit is.
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #AI
November 8, 2026 at 12:55 PM
Before a private Supabase table goes live, do you try updating a row as a second user and rewriting user_id?
That's the WITH CHECK hole that SELECT tests miss.
Curious what your pre-ship habit is.
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #AI
That's the WITH CHECK hole that SELECT tests miss.
Curious what your pre-ship habit is.
#Supabase #RLS #buildinpublic #vibecoding #AppSec #webdev #SaaS #AI
Honest question for people on Supabase: first RLS policy on a new table, do you write it owner-only, or open to every signed-in user and lock it down later?
#Supabase #buildinpublic #SaaS #AI #Lovable #AppSec #vibecoding #webdev
#Supabase #buildinpublic #SaaS #AI #Lovable #AppSec #vibecoding #webdev
November 7, 2026 at 10:35 AM
Honest question for people on Supabase: first RLS policy on a new table, do you write it owner-only, or open to every signed-in user and lock it down later?
#Supabase #buildinpublic #SaaS #AI #Lovable #AppSec #vibecoding #webdev
#Supabase #buildinpublic #SaaS #AI #Lovable #AppSec #vibecoding #webdev
A Centralia-area stepfather said he didn't vote but "kinda likes where this 638 thing is goin", adding "I'm real disappointed I'm just an electrician instead of the lucky guy who gets to look at under*ge g*rls' v*ginas".
November 6, 2026 at 5:50 AM
A Centralia-area stepfather said he didn't vote but "kinda likes where this 638 thing is goin", adding "I'm real disappointed I'm just an electrician instead of the lucky guy who gets to look at under*ge g*rls' v*ginas".
Air to Ground Message:
LOL WOW WHAT A FLIGHT TO TAKEOVER RLS 6 LOL WELCOME TO THE SHOW
Area: Tampa, FL, USA
Type: Boeing 737 MAX 8
A: #ac21bdc4975
F: #f33f8c8ef95
LOL WOW WHAT A FLIGHT TO TAKEOVER RLS 6 LOL WELCOME TO THE SHOW
Area: Tampa, FL, USA
Type: Boeing 737 MAX 8
A: #ac21bdc4975
F: #f33f8c8ef95
November 6, 2026 at 8:46 PM
Air to Ground Message:
LOL WOW WHAT A FLIGHT TO TAKEOVER RLS 6 LOL WELCOME TO THE SHOW
Area: Tampa, FL, USA
Type: Boeing 737 MAX 8
A: #ac21bdc4975
F: #f33f8c8ef95
LOL WOW WHAT A FLIGHT TO TAKEOVER RLS 6 LOL WELCOME TO THE SHOW
Area: Tampa, FL, USA
Type: Boeing 737 MAX 8
A: #ac21bdc4975
F: #f33f8c8ef95
Curious how people building on Supabase test RLS before launch.
Sign in as a second user and go after the first one's rows? pgTAP? A script in CI? Or is it on the list for after launch?
#Supabase #buildinpublic #SaaS #AI #vibecoding #webdev #Lovable #Postgres
Sign in as a second user and go after the first one's rows? pgTAP? A script in CI? Or is it on the list for after launch?
#Supabase #buildinpublic #SaaS #AI #vibecoding #webdev #Lovable #Postgres
November 6, 2026 at 10:35 AM
Curious how people building on Supabase test RLS before launch.
Sign in as a second user and go after the first one's rows? pgTAP? A script in CI? Or is it on the list for after launch?
#Supabase #buildinpublic #SaaS #AI #vibecoding #webdev #Lovable #Postgres
Sign in as a second user and go after the first one's rows? pgTAP? A script in CI? Or is it on the list for after launch?
#Supabase #buildinpublic #SaaS #AI #vibecoding #webdev #Lovable #Postgres
SNS開発の裏側、noteで公開中。
SupabaseのRLS設計とか、AdSense審査の話とか。
個人開発者の参考になれば。
https://the111.netlify.app
#個人開発 #Supabase #NextJS
SupabaseのRLS設計とか、AdSense審査の話とか。
個人開発者の参考になれば。
https://the111.netlify.app
#個人開発 #Supabase #NextJS
November 10, 2026 at 3:59 AM
SNS開発の裏側、noteで公開中。
SupabaseのRLS設計とか、AdSense審査の話とか。
個人開発者の参考になれば。
https://the111.netlify.app
#個人開発 #Supabase #NextJS
SupabaseのRLS設計とか、AdSense審査の話とか。
個人開発者の参考になれば。
https://the111.netlify.app
#個人開発 #Supabase #NextJS
QUINEAR Leg Massager, 3-in-1 Foot Calf & Thigh Massager with Heat and Compression Therapy, Leg Massage Boots Gift for Swollen Legs, Edema, RLS Pain Relief, FSA-HSA Eligible #RLS #compressiontherapy #thighmassager #varicoseveins #legmassager #calfmassager
QUINEAR Leg Massager, 3-in-1 Foot Calf & Thigh Massager with Heat and Compression Therapy, Leg Massage Boots Gift for Swollen Legs, Edema, RLS Pain Relief, FSA-HSA Eligible
www.amazon.com
November 10, 2026 at 3:26 AM
QUINEAR Leg Massager, 3-in-1 Foot Calf & Thigh Massager with Heat and Compression Therapy, Leg Massage Boots Gift for Swollen Legs, Edema, RLS Pain Relief, FSA-HSA Eligible #RLS #compressiontherapy #thighmassager #varicoseveins #legmassager #calfmassager
November 8, 2026 at 7:44 PM
pain severity is weird bc the ankle was the one that required the most & longest meds bc it was absolutely unrelenting
the tooth was worse in intensity but dulled pretty fast, same with the ankle break & the time i smashed my finger to pieces
but the pain of subluxing hips & RLS worse over time
the tooth was worse in intensity but dulled pretty fast, same with the ankle break & the time i smashed my finger to pieces
but the pain of subluxing hips & RLS worse over time
November 7, 2026 at 4:12 PM
pain severity is weird bc the ankle was the one that required the most & longest meds bc it was absolutely unrelenting
the tooth was worse in intensity but dulled pretty fast, same with the ankle break & the time i smashed my finger to pieces
but the pain of subluxing hips & RLS worse over time
the tooth was worse in intensity but dulled pretty fast, same with the ankle break & the time i smashed my finger to pieces
but the pain of subluxing hips & RLS worse over time
Quick Supabase check: open Storage and see which buckets are marked Public.
Public means any file is downloadable by anyone who has the URL. RLS doesn't come into it.
Fine for logos. Not fine for receipts, IDs or anything a user uploaded privately.
#Supabase #buildinpublic #webdev #AppSec
Public means any file is downloadable by anyone who has the URL. RLS doesn't come into it.
Fine for logos. Not fine for receipts, IDs or anything a user uploaded privately.
#Supabase #buildinpublic #webdev #AppSec
November 7, 2026 at 1:35 AM
Quick Supabase check: open Storage and see which buckets are marked Public.
Public means any file is downloadable by anyone who has the URL. RLS doesn't come into it.
Fine for logos. Not fine for receipts, IDs or anything a user uploaded privately.
#Supabase #buildinpublic #webdev #AppSec
Public means any file is downloadable by anyone who has the URL. RLS doesn't come into it.
Fine for logos. Not fine for receipts, IDs or anything a user uploaded privately.
#Supabase #buildinpublic #webdev #AppSec