Two exploits, one public API key: the day I attacked my own Supabase app
This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . Every app has its rockstar bug. Mine didn't crash, didn't throw, di…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
career
claude
cybersecurity
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
Coverage Before Creativity: The RAG Gate That Keeps My Blog Pipeline Honest
The first failure I had to eliminate in the blog pipeline was not a bad paragraph. It was a bad evidence set. The system was finding a few nearby chun…
Introducing tinbase — local Supabase without Docker (one process, real Postgres)
Supabase local dev = a 12-container, 2.3 GB Docker stack. tinbase serves the same APIs from one 58 MB process . No Docker. It's real Postgres 17 — RLS…
How to Check Supabase Row Level Security Holes (Free SQL Audit)
Row level security in Supabase fails quietly. There is no crash, no red error banner, nothing in your logs that says "this table is wide open." The ap…
When `await mutation()` lies: the `{ error }` destructuring that saves your weekend
Episode 2/4 of the mini-series The week Supabase lied to me 4 times . Episode 1 — 3 Supabase security incidents, one shared root cause: SECURITY DEFIN…
How I Fixed Supabase Storage RLS Errors That the Dashboard UI Couldn't Solve
If you've ever spent hours staring at a 400 error on a Supabase Storage upload despite having RLS policies correctly configured in the dashboard — thi…
I Moved My Next.js Dashboard Logic Into Postgres. My Frontend Got Boring (And That's the Point).
My dashboard had a useMemo doing arithmetic it had no business doing. It was a Pokémon TCG Pocket collection tracker, but that part doesn't matter. Wh…
I built an AI that predicts football matches before kickoff — and forces it to stay honest
Most football "tipster" sites have the same trick: they show you the winners and quietly bury the losers. I wanted to build the opposite — an AI that …
Supabase Shopify Backend: Side-Car Architecture (2026)
For high-volume merchants, relying solely on Shopify metafields to store relational data or custom customer records is an architectural dead end. A de…
How I Built Pathway AI: A Full-Stack SaaS Platform in 1 Month
How I Built Pathway AI: A Full-Stack SaaS Platform in 1 Month I built Pathway AI , a SaaS platform for international students planning their study abr…
I fuzzed my own Supabase RLS — and found a cross-tenant leak
Row-Level Security is the kind of thing that looks done. The policies are there, the app works, your tests are green. So you move on. The problem is t…
Supabase RLS Policy Design Patterns Beyond the Basics
Supabase RLS Policy Design Patterns Beyond the Basics Row Level Security is one of the most powerful features in Supabase — and one of the most misund…
Supabase Authentication & Authorization Patterns
Supabase Authentication & Authorization Patterns Authentication and authorization are the foundation of secure applications. Supabase provides a c…
I built an SEO-first internet radio site — and learned why `curl` can't validate audio streams
I recently built Radio Balkan — a single-page web player that puts 750+ Balkan radio stations in one place: no ads, no sign-up, no cookie banners. It'…
Next.js + Supabase Performance Optimization: From Slow to Lightning Fast
Next.js + Supabase Performance Optimization: From Slow to Lightning Fast Last month, I optimized a Next.js + Supabase application that was frustrating…
Add Video Processing to Your Vercel + Supabase App in 10 Minutes
Originally published at ffmpeg-micro.com Most Vercel + Supabase apps hit the same wall: a user uploads a video, and you need to do something with it. …
Your Test Data Is Type-Correct and Still Invalid: 6 Postgres Schema Features Generators Skip
Your Test Data Is Type-Correct and Still Invalid: 6 Postgres Schema Features Generators Skip TL;DR: Composite primary keys, partial unique indexes, cr…
How I Built an AI News Brief with Next.js, Supabase, Vercel, and GPT-4o-mini
Over the past few months, I have been building a small AI news brief called DeepSignal . The idea started from a simple personal frustration: I was re…
My Claude Code setup lived on three machines and none of them agreed
Branko, you built another tool? Yes. Yes I did. And before you roll your eyes — hear me out, because this one scratched an itch that was driving me ge…
Supabase's Management API OAuth Endpoint Switches From 201 to 200 on May 26 — Here's What Silently Breaks
On May 26, 2026, the OAuth token exchange endpoint for Supabase's Management API — https://api.supabase.com/v1/oauth/token — will stop returning 201 C…
I Audited 50 Vibe-Coded Apps. Here's What Broke.
I audited 50 Lovable / v0 / Bolt / Cursor / Claude Code apps over the last few months. Some were friends' side projects, some were YC-backed startups,…
Two weeks of building Bible School LMS in public: first contributor, bilingual content, real production bug
Two weeks ago I posted "Open Source Bible School LMS, we need your help" and asked for contributors. Today the first community PR landed. Plus a stack…
How to Download Your Entire Supabase Storage Bucket Locally
If you've been building with Supabase, you know their Storage API is fantastic for web apps. But sometimes, you just need your files on your local mac…
Why your MCP server should serve OAuth Protected Resource Metadata — AuthKit + RFC 9728
The problem: too many clients, too few discovery hooks We expose Supabase Edge Functions as MCP (Model Context Protocol) servers. The clients that hit…