Happy Halloween! Ember skipped the candy and went sniffing through Supabase Storage instead. The spookiest thing she found was user uploads anyone could open. Here's why: when a Supabase Storage bucket is set to Public, anyone with a file's URL can download it. That's fine for logos. It's scary for…
Ember promoted herself to Head of Security. Your users shouldn't be able to. Here's the catch: Supabase RLS policies decide which rows a user can update, not which columns. If role or is_admin lives on your profiles table and users can update their own row, they can set it from the browser with the…
Ember takes guest lists seriously. A "private" team app on Supabase may still let any stranger create an account. Here's why: Supabase Auth allows new user sign-ups by default. If your RLS policies say "any logged-in user can read," a stranger who signs up is now a logged-in user. The two-minute…
