How to fix infinite recursion in Supabase multi-tenant RLS policies

·3 views

Developers building multi-tenant apps on Supabase can accidentally create infinite recursion when Row Level Security policies on one table query another RLS-protected table, such as checking workspace membership inside a project access policy. The loop occurs because the policy on the projects table queries workspace_members, which itself triggers its own RLS evaluation, cycling indefinitely. The recommended fix is to wrap the membership lookup in a SECURITY DEFINER SQL function, which bypasses RLS and resolves workspace IDs using the definer's privileges instead of re-triggering policy checks. Setting search_path to an empty string within the function prevents search-path hijacking, a known security risk with SECURITY DEFINER functions. This pattern should be applied to all tenant-scoped tables, covering both read policies and write policies using WITH CHECK on inserts.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Clock Drift Broke a Redis Lock, Letting Two Workers Run the Same Billing Job

A nightly billing-reconciliation system designed to run once on one of three workers accidentally executed twice simultaneously, doubling entries for the same customer batch. The root cause was an NTP daemon that had silently stopped syncing after a container restart, leaving one worker's clock running roughly 9 seconds behind the Redis server's clock. Because Redis measures lock expiry using its own clock, the 30-second lock expired sooner than the worker expected, allowing a second worker to acquire it while the first was still running. The engineering team resolved the issue with three fixes: adding a background thread to auto-renew the lock, introducing monotonically increasing fencing tokens to reject stale writes, and adding explicit monitoring alerts on NTP synchronisation status. The incident highlights a fundamental risk in lease-based distributed locks — the lock server and client clocks must stay in close agreement, or the safety margin can silently disappear.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treat Scope Creep as a State Machine, Not a Client Problem

A framework published on DEV Community argues that scope creep is best managed as a structured state machine rather than blamed on difficult clients or poor relationships. Under this model, every new project request must be classified into one of four states: included, swapped, deferred, or added — before any work begins. The approach requires developers to calculate and communicate both the fee impact and schedule impact of each change, accounting for factors beyond raw coding time such as context switching, retesting, and displaced capacity. A standard response template is proposed to acknowledge requests, name scope boundaries, and obtain written approval without conflict. The author also recommends defining clear acceptance criteria at project kickoff to make future scope disputes easier to resolve by reference rather than negotiation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Tool Lets Solo Founders Automate Email Verification in Signup Bots

A new guide published on DEV Community explains how solo founders and non-engineers can fully automate account registration workflows, including the email verification step that typically requires manual intervention. The solution combines Playwright, a browser automation engine, with Claude Code, an AI coding agent, so users can describe tasks in plain English without writing code themselves. A key component is the UnCorreoTemporal MCP server, which provides the bot with a fresh disposable inbox for each run, eliminating the need to use personal or reused email addresses. The server supplies dedicated tools such as create_signup_inbox and wait_for_verification_email, allowing Claude Code to handle the entire signup loop autonomously. The approach addresses common pain points like personal inbox bottlenecks, flagged reused addresses, and the complexity of connecting real email accounts programmatically.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Launches Agentic Autofix for Code Scanning Alerts in Public Preview

GitHub released an agentic autofix feature for code scanning alerts in public preview on July 10, 2026, designed to automatically generate patches for identified vulnerabilities. The system moves each alert through multiple stages — from candidate patch generation through build, testing, security checks, and human review before any merge. Experts caution that simply measuring the percentage of alerts with a generated patch is a misleading success metric, as generation is only the first of many critical steps. A structured evaluation framework is recommended, using deterministic canary assignments, detailed failure classification, and predeclared reliability gates to ensure patches genuinely resolve security issues without introducing regressions. Broader deployment should be justified by bounded evidence and explicit safety checks rather than surface-level averages.

0 comments Read more at DEV Community