Prisma and Drizzle bypass Supabase Row Level Security by default, exposing all data

·1 views

Popular ORMs like Prisma and Drizzle connect directly to Postgres using the 'postgres' role, which owns app tables and carries the BYPASSRLS attribute, causing all Row Level Security policies to be silently skipped. Unlike the Supabase JS client, which routes queries through PostgREST and enforces RLS via unprivileged roles, ORMs open a raw SQL connection that bypasses those protections entirely. This means a query that correctly returns only one tenant's data via supabase-js could return every tenant's data when run through an ORM. The bypass is not due to superuser privileges — Supabase withholds those from postgres — but rather because of table ownership rules and the BYPASSRLS attribute assigned to the role. Developers are advised to point their ORM's connection string to a dedicated, non-owner role without BYPASSRLS to restore proper policy enforcement.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How the Internet Nearly Broke Between 2000 and 2002

Between 2000 and 2002, the global internet experienced a period of deep structural instability that went largely unnoticed by the public. The TCP/IP protocol stack, originally designed for a small network of academic nodes, had grown too large and complex to be safely updated or modified. The Border Gateway Protocol (BGP), responsible for managing global routing, struggled with rapidly expanding routing tables that pushed hardware to its limits, causing widespread connectivity disruptions. Engineers at major network hubs in cities like Frankfurt and London observed 'route flapping,' an unstable oscillation in routing data that triggered localized network collapses. This era, described as the Millennium Fracture, revealed that the internet's foundational architecture was ossifying under the weight of its own explosive growth.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Visualize NPU Latency Stages for Better Android AI Performance

Developers optimizing AI models for Android often focus solely on inference time, but real-world latency involves four distinct stages: CPU preparation, memory transfer, NPU computation, and output retrieval. The Neural Processing Unit is a domain-specific chip built for tensor operations, and a key bottleneck is moving data between system RAM and the NPU's local high-speed memory rather than raw compute speed. Google's AICore platform shifts model ownership from individual apps to the Android OS, reducing binary bloat and improving hardware scheduling. Using modern Kotlin and Jetpack Compose, developers can build visualization tools that break down each latency phase to pinpoint performance issues. Identifying whether slowdowns stem from memory bandwidth or compute constraints allows for more targeted and effective optimization.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Platform Engineering Builds Internal Tools to Help Dev Teams Ship Faster at Scale

As organizations adopt cloud-native technologies, infrastructure teams are evolving beyond traditional DevOps practices toward Platform Engineering. While DevOps focuses on collaboration, automation, and delivery, Platform Engineering goes further by creating internal platforms with reusable building blocks. These platforms abstract repetitive infrastructure tasks, allowing developers to focus on business logic rather than rebuilding deployment pipelines or monitoring stacks from scratch. A core principle is self-service infrastructure, enabling developers to provision environments and deploy applications without depending on platform teams. The goal is not to hide complexity but to manage it, helping organizations deliver software faster while maintaining consistency and reliability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six-Part Guide Shows How to Auto-Sync YouTube Playlists to Spotify with Python

A developer on DEV Community has published a six-chapter tutorial series teaching readers how to build a Python script that automatically syncs a YouTube playlist to Spotify on a daily schedule. The series covers everything from setting up API accounts for both platforms to writing the core code files and deploying the finished script. No prior programming experience is required, as each line of code is explained in plain English throughout the chapters. The full source code for the project is publicly available on GitHub at github.com/Towernter/youtube-to-spotify. Readers are advised to follow the chapters in order, as each one picks up exactly where the previous left off.

0 comments Read more at DEV Community