Developer builds SQL-based Supabase RLS audit tool that bypasses AI guesswork

·1 views

A developer has created a structured audit tool for Supabase Row Level Security (RLS) that relies on direct SQL queries rather than asking AI agents to infer security configurations. The tool queries Postgres catalogue views such as pg_tables and pg_policies to surface concrete issues including tables with no RLS, overly permissive policies, public storage buckets, and tables with RLS enabled but no attached policy. Unlike typical AI-assisted audits, the prompt instructs the model only to run a fixed SQL block and report results, ensuring findings are grounded in actual database state. The tool is designed to be pasted into AI coding environments like Claude Code or Cursor and runs against a live Supabase project in around thirty seconds at no cost. The developer noted that all detected issues can silently reappear after migrations or ad-hoc fixes, which motivated building a broader monitoring product called Defencecore to track catalogue changes over time.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Bulk Database Inserts Stay Slow Even When Your Code Looks Fine

A common performance trap in database-heavy applications involves foreign key dependencies that force inserts to pause and retrieve auto-generated IDs before proceeding. When loading relational data — such as bands and their associated songs — each child record cannot be built until the parent's database-assigned ID is returned, creating an unavoidable sequential dependency. This means the entire load is split into distinct phases that cannot overlap, preventing parallel processing across tables regardless of batch size tuning. SQLAlchemy's insertmanyvalues feature, using INSERT...RETURNING, can speed up this process roughly 15 times by batching ID retrieval, but the fundamental sequencing constraint remains. The article argues the real bottleneck is architectural — an application waiting on the database to assign identities — rather than query performance or indexing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Microsoft August 2026 Patch Tuesday: 790 CVEs Fixed, One Zero-Day Actively Exploited

Microsoft released its August 2026 Patch Tuesday update, addressing 790 vulnerabilities across its products, including 109 rated Critical and 396 rated Important. One zero-day, CVE-2026-68820, is already being actively exploited in the wild — a use-after-free elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock that can allow a local attacker to gain SYSTEM-level access. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog and affects all supported Windows versions, making it the highest-priority patch this cycle. Two additional flaws in the Windows User Profile Service and the Container Isolation FS Filter Driver were publicly disclosed before the update but have not yet been confirmed as exploited. The release also includes fixes for high-severity remote code execution bugs in Windows Deployment Services, SharePoint, and Azure SQL Database, among others.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Local vs Cloud LLMs: A Practical Framework for Choosing the Right Approach

Developers and organizations deploying AI in 2026 face a critical architectural choice between running large language models locally or using cloud-based APIs. Cost analysis shows that self-hosting becomes economical only beyond certain usage thresholds — for example, around 40 million tokens per month when compared to GPT-5.6 Sol pricing. Local deployment involves hardware, electricity, and engineering labor costs, while cloud APIs range widely from $0.14 to $10 per million tokens depending on the model. Beyond cost, the decision also hinges on privacy requirements, latency needs, vendor dependency risk, and long-term strategic flexibility. Hybrid architectures that combine both local and cloud models are increasingly popular as a way to balance these competing tradeoffs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Firefox extension to strip tracking codes from copied links

A privacy-conscious developer is building a Firefox browser extension that removes tracking parameters — such as utm_*, fbclid, gclid, and igshid — from URLs when copied. The tool adds a 'Copy clean link' option to the right-click context menu, stripping trackers while preserving legitimate query parameters and fragments. The developer, who is learning JavaScript from scratch, is following a public four-week build plan inspired by the 'Learn in Public' philosophy. The first version requires no host permissions and cannot read page content, keeping the extension minimal and privacy-safe. The long-term vision is a system-wide, cross-platform clean-link tool that works across all applications, not just browsers.

0 comments Read more at DEV Community