... comes down to. Two things I'd add from the outside view. On RLS, the service-role key bypassing policies is exactly why "it works" proves nothing, so the real test is running the same query with the public anon key from a logged-out session, since that's the one every visitor already has. On admin routes, they're usually not even guessed: in most SPA builds the route table ships inside the JS bundle, so the full list ... ... proper review, but all three catch the same class of mistake: something that worked in testing because the person testing it was already authorised. Comment from Arnold Oshenye(@oshylabs): @syef_sid_ali_benkrief  Good catch on the anon

... earlier notes. It exists, for auth endpoints. There's an open issue suggesting the configured value isn't always honored, so I treat it as a floor rather than a setting. RLS as the only actual barrier, since the anon role holds table grants by default. Size and MIME limits per storage bucket. Mine were empty, meaning any file type was accepted. The gap I haven't solved: PostgREST has no native per-IP limit. max-rows and RLS reduce ...

... Auth that only lives in the UI and endpoints that return someone else's record both show up in about five minutes that way. Second, check your Supabase or Firebase rules from the outside using just the public anon key, since that key ships to every visitor anyway. And search the built JS bundle, not only the repo, because client-side env vars end up in there. Rate limits are the one most people skip until a bill arrives ...

... avoid finding out the hard way. Any war stories or checklists appreciated. Comment from Siarhei Hamanovich(@siarheihamanovich): RLS on every table, no exceptions, and every policy keyed on auth.uid(). Never on a user id your frontend sends. Your anon key ships in the browser by design, so a table without RLS is readable by anyone who opens devtools. That's how a batch of Lovable apps leaked last year. My own app isn't on Supabase, but the rule ...

... using an LLM with MCP/plugins to help with policies. It got stuck, then disabled RLS "temporarily." Yeah. Temporarily. There are a ton of vibe-coded apps on Lovable, Base44, etc. on the same stack. Same risk: anon key in the client, policies that look fine until they aren't. So I spent a day on hackymacky. Paste a URL. It checks the client bundle for secrets and probes anon

... tools leave behind. Sharing the pattern in case it saves someone a bad week. 1. Open database (the #1 by far) Supabase with Row-Level Security off, or Firebase rules left wide open. Your frontend ships the public anon key, so if RLS is off, anyone who opens devtools can read/write every table. Fix: turn on RLS and write per-table policies, then test with the anon

... correct. A recent example: I had a security researcher report what looked like a real vulnerability. Turned out the AI-assisted fix from weeks earlier had shipped correctly, but the researcher's finding conflated two different things, the anon key being visible client-side (expected, normal) versus

... drift and reconcile immediately via pipeline re-sync. No manual propagation. Comment from Chalermpon Ananwattanakit(@vollos): most of the drift here reads as an outage risk. one key sits in a different category though: service_role. the anon key is public-safe by design, so it drifting mostly just breaks things noisily. service_role skips RLS entirely, so if that's the one mounted into a frontend or left in the wrong environment, you get a silent full-table read ... ... your structure differs, drift is guaranteed. Comment from Satish Pophale(@satish_pophale): We keep it simple with per-environment .env files and a validation script that runs pre-deploy to ensure all required Supabase vars ( SUPABASE_URL , SUPABASE_ANON

... Solo builder here, won't say much about the product yet but happy to talk shop on the plumbing. Quick version of what I'd tell my past self: Auth - Supabase, Clerk, Auth0, pick one. An afternoon of setup vs. days of building it badly. I tried the days version first, do not recommend. Permissions - this is the sneaky one. Most people check "can this user see this?" in their app code. Way better to push the rule into ... ... tattoos or mockups) Tech-wise I m using: Flutter for the mobile app Firebase (Firestore + functions) OpenAI + Replicate for image generation (testing multiple models right now like DreamShaper, Flux, Ideogram) Biggest challenge so far has been balancing quality vs

... everyoby thank you so much for helping me out in this launch! Let s use this forum to discuss anything related to anonity and your experience so far! I m looking for ways to make anonity

... thing we wanted to be very clear about with Supaguard.pro : We don t ask for service tokens, API keys, or credentials. Ever. Supaguard only looks at what s already public on the internet . If an endpoint, config, or anon key is accessible without logging in, Supaguard can see it. If it needs authentication or a private token, Supaguard simply ignores it. Why we designed it this way Most real-world breaches don t start with stolen credentials. They start with ...