Missing Row-Level Security Quietly Became One of the Biggest Database Breach Causes

·1 views

Failing to enable Row-Level Security (RLS) on database tables has emerged as a leading cause of data breaches in 2025-2026, with encryption receiving far more attention than this more critical access-control gap. A May 2025 vulnerability (CVE-2025-48757) exposed data from 303 endpoints across 170 apps built with the AI tool Lovable, because Supabase RLS was never switched on. Security researchers have also identified hundreds to thousands of Supabase instances globally that can be queried using only a public anonymous key and a basic curl request. The problem is not new or platform-specific — a similar Firebase misconfiguration previously leaked sensitive data belonging to over 1.8 million users across more than 900 apps in health, finance, and education. Supabase has since enabled RLS by default on new tables, but experts warn the risk remains highest during database migrations, when access-control logic must be manually rebuilt from scratch under time pressure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Kimi K3 Tops Design Arena Rankings but Wins Only 1 of 5 Head-to-Head Rounds

A YouTube channel with 202,000 subscribers published a 6-minute video on September 12, 2026, claiming Kimi K3 dominates Design Arena and questioning whether developers are paying for the right AI model. The video tested Kimi K3 against Fable and Astra across five one-shot design tasks: a landing page, a 3D scene, a component library, a mobile app, and a game with custom assets. Kimi won only the landing page round, while Astra won the 3D scene, Claude won the game task, the component library ended in a draw, and no winner was declared for the mobile app round. Despite this, Kimi K3's top ranking on Design Arena is supported by aggregate data from over 8,650 competitions, where it holds a 64% win rate and ranks first in landing page and data visualization categories. The video unintentionally highlights that ranking first most frequently across thousands of matches is fundamentally different from winning every individual head-to-head comparison.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Zero-Parameter Document Cache Outperforms 1.4M-Parameter Transformer on Long Texts

A new experiment compared six language-prediction systems to measure how a simple document-frequency cache stacks up against a 1.43-million-parameter transformer with a fixed 64-token window. At short document lengths (around 60 tokens), the transformer holds a clear advantage, but the cache overtakes it somewhere between 60 and 250 tokens without any training, parameters, or significant compute cost. By 1,000 tokens, the cache leads by 0.064 top-1 accuracy — a 43% relative margin — because the transformer's fixed window cannot access most of a long document. When both mechanisms are combined, adding the full transformer on top of the cache contributes only 0.002 top-1 accuracy at L=1,000, suggesting the cache nearly replaces the neural model's contribution as documents grow. The findings highlight that document length is a resource the cache can exploit while the transformer structurally cannot.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pixxel Raises $100M Series C, Becomes India's Best-Funded Private Space-Tech Firm

Bengaluru-based hyperspectral satellite startup Pixxel closed a $100 million Series C round on September 7, co-led by Temasek and Seraphim Space, bringing its total funding to $195 million — the highest ever for a private space-tech company in India. New investors 360 ONE Asset and South Korea's IMM Investment joined existing backers in the round, which was founded in 2019 by Awais Ahmed and Kshitij Khandelwal. Separately, Jio Platforms has begun investor outreach for its anticipated IPO, with roadshows planned across the US, Singapore, Hong Kong, London, and the Middle East, targeting a valuation of around $137 billion. On the quantum-security front, Bengaluru's QNu Labs raised ₹200 crore in a Series A1 round led by India's National Quantum Mission, taking its total funding to ₹375 crore. The week also saw PB Fintech's payment aggregator PB Pay go live for merchant sign-ups and Mahindra Finance expand its voice-AI partnership with Sarvam AI across 12 Indian languages.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Static Typing Helps Developers Manage Growing Codebases Safely

In small projects, developers can easily track function expectations and object structures from memory, but this becomes unreliable as codebases expand with more contributors and components. Static typing, as offered by TypeScript, converts implicit assumptions into compiler-enforced contracts, reducing the risk of undetected errors. This proves especially valuable during refactoring, where changes to shared functions or objects can silently break unrelated parts of an application. Type safety does not replace testing or guarantee bug-free code, but it shifts many runtime errors to compile time. Its greatest advantage in large systems is reducing the mental load on developers, making complex codebases easier to modify with confidence.

0 comments Read more at DEV Community