Public Supabase Storage buckets can expose private user files to anyone with a link

·1 views

A DEV Community post warns that Supabase Storage buckets marked Public let anyone with a file's URL download it. This is acceptable for non-sensitive assets like logos but risky for invoices, IDs, or private photos. The author advises checking each bucket's Public label in the Supabase dashboard. For private data, buckets should be made private, access governed by policies on storage.objects, and expiring signed URLs used. The post also promotes a SniffPup scanning service for finding other exposed areas of an app.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Designing Thumbnail Annotations Around Intent, Not Just Editor Controls

A design proposal argues that thumbnail editors should model text and arrows as annotations that carry a stated purpose rather than only exposing visual controls. Text annotations would record a message and a readability condition, while arrow annotations would require a target and direction. The author suggests a staged review process for text, locking the hook before comparing weights, spacing, and separation effects. For arrows, the proposal recommends blocking export when no target label is given or contrast has not been checked. The approach aims to make design reviews more repeatable and specific, though it does not claim data-backed testing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Celery Workers Can Leave Orphaned Subprocesses When Terminated, Article Explains

The article describes how a Celery worker shutting down after receiving SIGTERM can fail to pass the signal on to child subprocesses it spawned. Those children are then reparented to PID 1 and keep consuming CPU, memory, and resources. The author proposes a ZombiePreventionContext context manager that tracks and cleans up child processes during abrupt shutdowns. The approach is validated with a local simulation that sends SIGTERM mid-execution and checks cleanup. Recommended practices include using shell=False so signals reach the target process directly, and a staged cleanup that sends SIGTERM first and falls back to SIGKILL after a timeout.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Client-Side WebP to PNG Converter: Five Lessons From Building One

A developer needed to use a WebP logo in an older editor that rejected the format, and found that renaming the file does not actually convert it. The resulting weekend project was a browser-based converter that decodes images to pixels on a canvas and re-encodes them without uploading files. The author notes that converting lossy WebP to PNG cannot improve quality, since PNG only preserves the decoded image, including existing compression artefacts. The article also explains that transparency cannot survive a JPG conversion, so a background fill must be chosen, which is a design decision rather than a technical default. The author discloses building the tool, so the piece is a build log rather than a neutral review.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

When the UK VAT Flat Rate Scheme Saves Freelancers Money, and When It Costs More

UK freelancers and small business owners registered for VAT can use the Flat Rate Scheme, which lets them pay HMRC a fixed percentage of gross turnover instead of tracking VAT on every purchase. The fixed rate depends on the trade, with around 14.5% common for service businesses and a 1% discount in the first year of registration. The scheme suits businesses with low VAT-able costs, such as consultants or designers who mainly sell their own time, since they keep the difference between the VAT charged and the flat rate paid. It can be costly for businesses with heavy VAT-bearing spending, as everyday input VAT generally cannot be reclaimed. Service-based traders whose spending on goods is below 2% of turnover or £1,000 a year may be classed as limited-cost traders and face a higher 16.5% rate, which rarely beats standard accounting.

0 comments Read more at DEV Community