Developer finds invite gate bypass via database access in FastPass build log

The author of FastPass, a paid inbox product, had secured their invite-only gate on the server after earlier moving it out of the browser. Reader feedback prompted a check of the database layer, which Supabase exposes directly to the browser through PostgREST and governs with Row Level Security. Testing confirmed that RLS allowed clients to write a value the gate relied on, meaning the gate could be bypassed. To avoid touching production data, the author rebuilt the schema from read-only catalog queries into a disposable Postgres instance and verified it matched production using a policy hash. They then ran 70 probes as anonymous, logged-in, and service-role callers, each inside a rolled-back savepoint, and the first run exposed several classes of problems.