Permetra: Open-Source Access Graph Tool Aims to Simplify Supabase Security

·72 views

A developer is building Permetra, an open-source security tool designed to visualize access control in Supabase-based applications. As apps scale, permissions spread across users, roles, tenants, tables, and row-level security policies, making the full access picture hard to track. Permetra addresses this by generating an interactive graph, inspired by the security tool BloodHound, to help developers explore access relationships and paths visually. The tool aims to surface unexpected access routes, review tenant isolation, and clarify why a user can reach a given resource. The project is still in its first version, and the developer is actively seeking feedback from Supabase users, security engineers, and open-source contributors.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Connector design should expose partial failures so agents can tell empty results from errors

A connector returning an empty array can signal several different outcomes, including a successful query with no matches, a request that failed before reaching the service, a partially loaded result, or unparseable data. The article argues these should be distinguished, since an agent cannot safely decide its next step if all of them appear as an empty list. It proposes returning results as structured reports that state the status (complete, empty, partial, retryable error, or action required), the source, the fetch time, and any continuation cursor or warnings. Continuation cursors should be saved only after a page is accepted, so an interrupted pagination can resume rather than presenting an incomplete list as complete. For write operations, the author recommends idempotency keys and recording whether an operation was confirmed, since a timeout after a write leaves the outcome ambiguous.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Organizations: Using Multiple Accounts, OUs and Service Control Policies

The author extends their AWS setup beyond a single account, arguing that separate accounts act as strong boundaries for security, cost and blast radius. The guide explains key terms such as organizations, management and member accounts, OUs, and service control policies (SCPs). It notes that accounts roll up to one consolidated bill, that SCPs only restrict permissions and never grant them, and that they do not apply to the management account. Suggested steps include creating an organization, enabling MFA on the management root user, and setting up a Sandbox OU with a deny policy. Common mistakes to avoid include running workloads in the management account and reusing email addresses across accounts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Caching Cut a Product Page's Load Time from Three Seconds to Three Milliseconds

A product page that took three seconds to load dropped to three milliseconds after its developers added caching, with the same server, database and code. Caching works by storing a copy of frequently requested data closer to where it is needed, so repeated requests skip slow database queries. The common cache-aside pattern checks the cache first and falls back to the database on a miss, then stores the result with an expiry time. The article also warns that cached copies can go stale when source data changes, and recommends writing to the database first and then deleting the cache entry rather than updating it.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Brooklyn building collapse leaves eight dead, according to latest reports

A building in Brooklyn, New York, has collapsed, and at least eight people have been confirmed dead so far. The New York Times is covering the incident with a live updating page. The source material provided is limited to a headline and a link, so details about the cause, the number of injured, and rescue efforts could not be verified here. Officials and further reporting are expected to clarify the circumstances as the situation develops.

0 comments Read more at Hacker News