[deleted]
Your Supabase is public if you turn off RLS
21–30 of 69 posts
Re: Your Supabase is public if you turn off RLS
#22[dead]
Re: Your Supabase is public if you turn off RLS
#23After seeing the responses, I believe that this is more evidence of the fact that Supabase is easy to work with (and thus attracts people who have NO IDEA what they’re doing), and less an issue with Supabase security.
Re: Your Supabase is public if you turn off RLS
#24I find that supabase is pretty good at warning you about these things in their project specific security advisories, but obviously you need to actually pay attention to them and then take action.
Re: Your Supabase is public if you turn off RLS
#25Earlier quoted context omitted.
People are using LLMs to generate apps and it's easy for non-technical people to miss this stuff. The blog post mentions https://lovable.dev/ becoming a $300M company, which uses Supabase by default and basically generates React SPA's with no true backend. But random people won't understand this distinction and will want to create full real apps. Doing this serverless is tricky and requires a lot of careful thought t…
> The blog post mentions https://lovable.dev/ becoming a $300B company I had to double take back to the article after reading this - it actually said $330M (raised at $6.6B valuation). AI investment has been crazy enough I would have actually believed it though!
Fixed, thanks
Re: Your Supabase is public if you turn off RLS
#26Earlier quoted context omitted.
My experience is watching a colleague use lovable which will mostly ignore security. Sure, if you prompt it the system will do something which seems correct, but it will also happily undo that as well. eg I was trying to help her set up a webhook listener, and it undid our efforts. These tools seem incapable of building software in the hands of users who don't understand security already.
> These tools seem incapable of building software in the hands of users who don't understand security already. These tools are for augmentation of skills, not for wholesale "imma a programmer now", which a lot of people seem to think. And to be honest, lots of companies are selling that "experience" too, even though they know it isn't true, a bit shit.
It's definitely pushed as not needing an engineer.
My colleague now understands why unit tests, after watching subsequent development regularly break previous work. Lovable doesn't support them. And I don't want to touch this codebase because I don't want to own it.
Re: Your Supabase is public if you turn off RLS
#27The problem is that people just really do not comprehend what the "public" schema means in supabase. My guess is that that they think it means "default" or something along those lines. If you read the supabase documentation, you can clearly see that it says "your database's auto-generated Data API exposes the public schema by default", but to truly understand that, you need to understand what the data api is and how…
Interesting. That would have surprised me if I was a supabase user. I’m used to tossing everything into the public Postgres schema simply because it’s the default schema, and for many small apps, that’s all you need. Supabase should really rethink publicly exposing the default schema without explicit consent from the developer.
Re: Your Supabase is public if you turn off RLS
#28I don't understand this. In supabase, the default is to turn on RLS for new tables. If you turn it on and have no policy set, no user can fetch anything from the table.
You have to explicitly create a read-all policy for anon keys, and with no constraints, for people to get access to it.
The default is secure.
If you turn off RLS, there are warnings everywhere that the table is unsecured.
The author goes on to compare this with PocketBase, which he says you "have to go out of your way" to make insecure. You have to go out of your way with Supabase, as well!
I wonder if the author tested this? I do agree that some third party website builders who use supabase on the back end could have created insecure defaults, but that's not supabase's fault.
Re: Your Supabase is public if you turn off RLS
#29One thing I find about these "all in one" platforms is that they tend to lure people into a sense of "wow this is easy to use" such that they forget to check security, assuming it's covered.
This is one reason why Firebase was such a gold-mine for security researchers: everyone just forgot about security when they forgot about their backend.
Re: Your Supabase is public if you turn off RLS
#30One thing I find about these "all in one" platforms is that they tend to lure people into a sense of "wow this is easy to use" such that they forget to check security, assuming it's covered. This is one reason why Firebase was such a gold-mine for security researchers: everyone just forgot about security when they forgot about their backend.
Any time I see a product like Firebase that rolls auth and other major features into a database I roll my eyes.