Free tool lets developers test Supabase row-level security policies before shipping

·1 views

A developer has released a free, open-source fixture on GitHub called supabase-rls-leak-demo that lets teams verify whether their Supabase row-level security (RLS) policies correctly isolate one user's data from another. The tool runs PostgreSQL locally via PGlite, requiring no Docker, no live Supabase project, and no credentials. It ships alongside a nine-query SQL audit script that checks RLS coverage, policy roles, write predicates, and privilege settings directly against system catalogs. The release addresses a gap in Supabase's built-in linter, which confirms whether a policy exists but cannot verify whether the policy logic is actually correct. Cross-user data leaks most often originate in that gap, making pre-ship policy testing a critical step for apps built quickly or with AI coding tools.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a CDN Works Between Your Browser and Origin Server

A Content Delivery Network (CDN) is a distributed system of edge servers that delivers web content from locations geographically closer to users, reducing latency and origin server load. When a user makes a request, routing technologies like DNS-based routing and Anycast direct traffic to the nearest edge location, which checks if it can serve the content from its local cache. A cache hit means the resource is served directly from the edge without contacting the origin, while a cache miss triggers a fresh fetch from the origin server, which may then be stored for future requests. Cache duration is governed by Time to Live (TTL) settings, which vary based on how frequently content changes, and CDNs also offer purge mechanisms for immediate cache invalidation. Beyond caching, modern CDNs can also optimize the network path for dynamic or uncacheable content such as API responses, authenticated pages, and personalized data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

UchenML Lets Developers Compile Neural Networks Directly Into C++ Binaries

UchenML is a C++20 machine learning framework that embeds trained neural network models as compile-time constants directly inside C++ binaries, eliminating the need for separate model loaders or runtime file parsing. The framework represents model architecture as composable layer values, allowing parameter counts and shapes to be verified at compile time via static assertions. Weights are stored as flat float arrays and can be memory-mapped or packed in fp16 format, as demonstrated in a live browser demo running a model with over 2.7 million parameters. Training is supported within the same framework using immutable state updates and optimizers such as SGD and Adam, with the final output being a plain float array ready for deployment. Built with Bazel and tested across MSVC, GCC, and Clang, UchenML prioritizes portability and integration ease over Python-based alternatives.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Team Used Postgres Advisory Locks to Safely Reset Monthly Usage Quotas

A development team building a subscription-based app encountered quota reset failures for yearly subscribers and free-tier users, since both groups never trigger monthly payment events. To fix this, they built a Spring scheduler that runs at 00:05 UTC on the first of each month, decoupling quota resets from billing cycles entirely. The solution uses Postgres's pg_try_advisory_xact_lock to ensure only one application instance executes the reset job, even in multi-instance deployments. The non-blocking 'try' variant means competing instances exit immediately rather than queuing up, while the transaction-scoped lock auto-releases if the process crashes. The five-minute cron offset was deliberately chosen to avoid the load spike caused by multiple infrastructure jobs firing at exactly midnight.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Docker's YOLO Mode and the Case for Permission-Level AI Agent Security

Docker this week launched a feature called YOLO mode within its Sandboxes product, giving AI coding agents like Claude Code and GitHub Copilot CLI isolated microVMs with outbound firewalls so they can run unattended without human oversight. Unlike standard containers, each session uses a dedicated microVM with its own kernel running on a hypervisor, providing stronger isolation for agents that install packages and execute arbitrary commands. A senior software engineer at BS23 in Dhaka, building production AI agents with Spring Boot and Spring AI, argues that a microVM cage suits coding agents but not conversational e-commerce assistants with defined tool sets. During adversarial testing, the engineer discovered that a product description embedded with fake user instructions caused the agent to follow those instructions instead of answering the customer's question — an indirect prompt injection attack originating from the agent's own catalog. This highlighted three distinct attack channels for tool-equipped agents: direct user injection, indirect injection via tool outputs, and privilege abuse through tool side effects, each requiring its own targeted defense rather than process-level sandboxing.

0 comments Read more at DEV Community