Row level security compares auth.uid() with the row's owner. When the request carries no JWT, auth.uid() is null, every comparison is false, inserts fail with 42501 and selects come back empty with no error at all. The SQL editor hides it too: on its default role it runs as postgres, which row…
3 Supabase RLS Leaks I Found in Production Apps This Week (and the 30-Second Check for Each) I audit Supabase apps for a living. This week I read the public source of three real, live products — a university dorm-management system, a freelancing marketplace, and an embedded product configurator —…
This is Part 2 of our technical series on building a high-speed, lightweight school marketplace. In Part 1: Why We Ditched Frameworks for Vanilla JS & PWA ( https://dev.to/juna_go15/building-a-high-speed-school-marketplace-why-we-ditched-frameworks-for-vanilla-js-pwa-27dl ), we discussed how we…
