Eight Supabase security flaws in AI-built apps that expose user data — and how to audit them

·1 views

Apps built with AI coding tools like Lovable and Bolt on Supabase may function correctly while silently exposing sensitive user data. In March 2025, a reported vulnerability — later assigned CVE-2025-48757 — revealed that over 170 Lovable-generated apps shipped without effective Row Level Security, leaving emails, payment data, and API keys accessible. Lovable responded with a built-in security scanner in version 2.0, but the scanner only checks whether RLS is enabled, not whether the underlying policies actually restrict data access. A security researcher has identified eight common RLS failure patterns, including user-writable role metadata, disabled RLS on public tables, and overly permissive policies that grant all authenticated users access to all records. Each flaw can be identified within minutes using Supabase's SQL editor, and the researcher recommends developers audit their own projects immediately.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

RAG Explained: How AI Models Answer Questions Using External Documents

Retrieval-Augmented Generation (RAG) is a technique that allows large language models to answer questions using documents they were never trained on, without any retraining or fine-tuning. First introduced in a 2020 Facebook AI Research paper by Patrick Lewis and colleagues, RAG works by searching external documents for relevant passages and feeding them as context to the model before it generates a response. The approach addresses two core limitations of LLMs: knowledge frozen at training time and no access to private or proprietary data. A typical RAG pipeline involves chunking documents, converting them into vector embeddings, storing them in a vector database, and retrieving the closest matches to a user's query at request time. Research has shown that retrieval quality matters significantly, with fewer but more relevant chunks generally outperforming larger, poorly ranked result sets.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI21 Labs cuts 61% of staff, pivots to enterprise AI orchestration amid acquisition rumors

Israeli AI firm AI21 Labs, known for its Jurassic and Jamba language models, laid off 110 of its 180 employees in May 2026 as part of a strategic shift away from standalone model sales toward enterprise orchestration. The company had raised $300 million in mid-2025, bringing its total funding to $636 million, with backing from Google and Nvidia. Its new Maestro platform, announced in March 2025, is designed to coordinate complex, multi-step AI tasks across models from multiple providers. AI21 has also forged cloud partnerships with AWS and Google Cloud to support its infrastructure ambitions. Acquisition interest from Nebius Group has since emerged, highlighting the perceived strategic value of AI21's hybrid Mamba-Transformer architecture and orchestration technology.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Developers Should Build a Life and Identity Beyond Tech

A developer-focused opinion piece on DEV Community argues that many software professionals unintentionally allow technology to consume their entire personal and social identity. The author observes that because tech work is mentally demanding and desk-bound, developers often lack the energy to socialize outside familiar professional circles, weakening their broader communication skills. This creates a reinforcing cycle where limited outside interaction makes future non-tech socializing feel increasingly uncomfortable. The author recommends pursuing offline hobbies unrelated to technology — such as painting, photography, or book clubs — to practice communicating with people from diverse backgrounds. Joining groups like Toastmasters is also suggested as a structured way to build public speaking and interpersonal skills beyond the tech bubble.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Makes Coding Easier, But Shortcuts Don't Make You an Engineer

On Engineer's Day, observed on September 15 in India, Sri Lanka, and Tanzania, developer Dhruv Jani reflects on how AI coding tools have blurred the line between generating software and truly understanding it. He argues that deploying an AI-built app without grasping its architecture or limitations does not constitute engineering. Jani draws on his own experience rebuilding ShelfTalk, a MERN-stack book-club app, for production as part of GitHub's Finish-Up-A-Thon challenge, where he finished in the top 10 among 500-plus entries. A post-launch bug later revealed that his push-notification optimization silently dropped messages for users viewing ShelfTalk on a second monitor, because tab visibility does not equal user attention. The incident underscored his central point: shipping something that works is not the same as understanding why it works.

0 comments Read more at DEV Community