Launched this week
Supabase RLS Leak Demo
Reproduce a cross-tenant RLS leak and verify the fix
4 followers
Reproduce a cross-tenant RLS leak and verify the fix
4 followers
A tiny, runnable Supabase/Postgres security fixture that proves a policy can look correct and still leak rows across tenants. The same test suite runs red on the broken policy and green after the one-file fix. Start with npm ci && npm test—no Docker, cloud project, credentials, or production data required. Built for founders and developers who want evidence before shipping multi-tenant apps.
I built this after seeing teams treat “RLS enabled” as proof that tenant isolation works. It is not. A policy can pass happy-path checks while a relationship or ownership condition still exposes another tenant’s rows.
This repository makes the failure visible with one red/green fixture and the same test suite on both branches. You can inspect the SQL, reproduce the leak locally, and verify the minimal fix without sharing credentials.
If you find a pattern the fixture should cover, I’d genuinely like to hear it. For teams that want a second set of eyes, I also offer a fixed-scope 24-hour review of three sensitive tables. Launch offer: $15.20 total, $7.60 deposit today:
https://cengokurtoglu.gumroad.com/l/supabase-rls-3-table-review/LAUNCH20?utm_source=producthunt&utm_medium=maker_comment&utm_campaign=rls_review