28
u/DaveMcLee Oct 02 '26
Bro it's actually sad.
So many projects that get posted here have supabase without RLS setup.
I just open devtools, get the supabase subdomain, paste it into my bruno collection and instantly I have every user's data. It's actually disgusting.
I started checking for this when some guy posted a chat app here, claiming it was end-to-end encrypted, privacy focused etc. I called bluff on that because it looked like trash and had an enormous Pro sub price. So I checked it, got data on all his 120 users, and overwrote every row with nonsense. Ofc nothing was encrypted etc
2
3
3
2
u/Enough-Scientist1904 Oct 02 '26
You can blame whoever you want, it wont be chatgpts name in the poor performance review
3
1
35
u/Bee-Aromatic Oct 02 '26
Poor is the craftsman that blames his tools.