Your Supabase anon key can probably read your whole users table
Here is a Supabase row-level security policy. It was on a profiles table holding names, timezones and weekly availability for real people. create po…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Supabase .NET DevLog #7
Welcome to our weekly log for the Supabase .NET SDK 🎉 Last week, I continued tweaking the quality gate, especially regarding code coverage. I faced…
Running a Monitoring SaaS on Cloudflare Workers + Supabase for Almost Nothing
Originally published on the Merlonix blog . Merlonix monitors uptime, SSL/TLS, DNS, email authentication, blacklists, Certificate Transparency, Core…
PostgreSQL Connection String: Supabase, Neon, Railway
The short version A PostgreSQL connection string is a single URL that tells a client how to reach your database. It looks like this: postgresql : //…
Supabase .NET DevLog #6
Welcome to our weekly log for the Supabase .NET SDK 🎉 Following the monorepo migration, I started working towards the new major v8.0.0: Upgraded all…
Test your Supabase RLS before you ship: a free red/green fixture and the 9 SQL checks a linter cannot run
If you built a Supabase app quickly - with an AI coding tool or by hand - the row-level-security policies were often written last, or generated for…
Row Level Security in Lovable apps: why your database might be public
Originally published on howsafeismyapp.com . Here is the uncomfortable truth about most Lovable apps: the database is not behind your login form. It…
Build vs Buy: What Founders Get Wrong About Templates
Every week a founder DMs me the same question: "Should I build my React Native app from scratch or buy a template?" Here's the framework I use to an…
7 Security Checks Before Shipping an AI-Built Next.js + Supabase App
7 Security Checks Before Shipping an AI-Built Next.js + Supabase App AI coding assistants can dramatically reduce the time between an idea and a wor…
How I Built NeuroSpace: An AI Productivity Platform That Actually Thinks With You
Most productivity apps are passive. They hold your tasks and wait. You still have to decide what to work on, estimate how long things take, and figu…
Every Supabase key, what it does, and which ones can be public
I audit apps built with AI tools. Most of the exposed credentials I find are Supabase keys, and most of them are not a problem. That is the part peo…
Two errors, one error code, and an hour in the wrong editor : What i learnt building WP-Supabase Sync
If you write to Supabase from anything, sooner or later Postgres hands you SQLSTATE 42501 . It means one of two things: permission denied for table…
The Project That Quietly Died While I Wasn't Looking
This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . The project I built Kenya Tours, a tour booking site at kenya coa…
I Built Kikar — An AI Messaging Platform That Creates Digital Versions of People
For the last few months, I've been working on Kikar, an AI-powered social messaging platform with a simple goal: What if every user could have an AI…
Sign in with Apple broke with invalid_client after 6 months? Here's why — and how to never deal with it again
If you're here because Apple login on your production app suddenly started failing with invalid_client — and you changed nothing — this post is for…
Two exploits, one public API key: the day I attacked my own Supabase app
This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . Every app has its rockstar bug. Mine didn't crash, didn't throw,…
Why I Kept Search Scope Inside a Single Supabase RPC
A retrieval system returned the right embedding, the right similarity score, and a completely wrong answer. The chunk it surfaced shared vocabulary,…
Vector Split by Chunk: Why My Retrieval Stops at the Boundary I Drew
I watched a draft miss the exact file span I needed, and the failure was embarrassingly clean: the vector was "close," but the chunk I wanted was bu…
Coverage Before Creativity: The RAG Gate That Keeps My Blog Pipeline Honest
The first failure I had to eliminate in the blog pipeline was not a bad paragraph. It was a bad evidence set. The system was finding a few nearby ch…
How I Built a 300+ Chapter Coding Platform with Angular SSR + Supabase (Solo, Free-Tier)
I recently opened up DevInHyderabad, a free coding-course site with 300+ chapters across 7 courses. I built it solo, part-time, entirely on free tie…
Introducing tinbase — local Supabase without Docker (one process, real Postgres)
Supabase local dev = a 12-container, 2.3 GB Docker stack. tinbase serves the same APIs from one 58 MB process . No Docker. It's real Postgres 17 — R…
InsForge vs Supabase: AI-Native Backend Alternative
Originally published on the InsForge blog , written by Hang Huang (CEO & Co-Founder of InsForge). Reposted here with permission. Supabase and In…
How to Check Supabase Row Level Security Holes (Free SQL Audit)
Row level security in Supabase fails quietly. There is no crash, no red error banner, nothing in your logs that says "this table is wide open." The…
Supabase .NET DevLog #2
Welcome to our weekly log for the Supabase .NET SDK! 🎉 Last week, I continued building our momentum on improving the overall experience with the SDK…
Supabase Backups Don't Include Your Storage Files. Here's What Does.
The restore finished clean. pg_restore exited 0, every table came back, row counts matched, the app booted. Twenty minutes later the first support m…
The Supabase RLS gotcha nobody warns you about: infinite recursion in multi-tenant policies
You're building teams/workspaces on Supabase. A row belongs to a workspace, and a user can touch it if they're a member. Simple enough — until your…
Fix: "new row violates row-level security policy" in Supabase (it's not what you think)
If you've shipped anything on Supabase, you've hit this: new row violates row-level security policy for table "notes" ``` Your first instinct is…
When `await mutation()` lies: the `{ error }` destructuring that saves your weekend
Episode 2/4 of the mini-series The week Supabase lied to me 4 times . Episode 1 — 3 Supabase security incidents, one shared root cause: SECURITY DEF…
Your AI-built app works in the builder but breaks on deploy with a Supabase "permission denied" error. Here is why, and how to fix it.
You built an app in Lovable, Bolt, v0, or Cursor. It worked perfectly in the preview. You deployed it, opened the live URL, and now half the screen…
Supabase vs Firebase
Both Supabase and Firebase promise the same thing: a backend you don't have to build, with auth, a database, storage, and real-time out of the box.…