Supabase apps built with AI tools may let users grant themselves paid plans

·3 views

Many apps built with tools like Lovable, Bolt or Cursor handle upgrades with a single client-side database update that sets a flag such as is_pro. The article explains that a common row-level security policy, which lets users update their own profile row, does not restrict which columns they can change, so billing fields can be altered from the browser console. It describes a quick console test to check whether a free account can upgrade itself, and recommends column-level grants or a database trigger to block changes to billing fields. The author also advises storing subscriptions separately and setting plans only through a verified payment webhook, and notes that the guidance applies only to apps the developer owns.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How the RISC acronym faded from ARM's name over decades of processor history

A developer recounts their path from hand-keying hexadecimal machine code on a Samsung SPC-1000 to writing ARM assembly on embedded Linux boards. They describe learning MASM in a systems course and studying the RISC design ideas of pipelining, hazard handling, compiler techniques, and caching. The author notes that the RISC-versus-CISC rivalry later seemed largely pointless, since Intel's Pentiums borrowed RISC ideas and the RISC instruction count was never truly small. Their own experience with ARM, XScale, and Linux smartphone projects led them to realize the R in ARM no longer clearly means RISC.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Designing Explainable Handoffs Before Automating Them

A fallback that sends an item to a person is incomplete if the reviewer cannot tell why it arrived, what the system already checked, or which source is authoritative. The article argues that handoffs should carry the observed facts, the system's interpretation, unresolved questions, and a clear requested action, so a reviewer can reject an interpretation without losing the evidence. It separates reception and commercial follow-up work, since an unresolved service issue should not automatically become a sales opportunity. It also calls for clear ownership, explicit state transitions, and escalation paths to avoid duplicate tasks and responsibility gaps. The author presents these as proposed requirements with an illustrative example, not as deployed or measured results, and suggests tracking unresolved ownership and corrected interpretations alongside response time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PHP Core Flaws Dubbed PHP2Shell Allow Unauthenticated Server Takeover

Two critical vulnerabilities in the PHP runtime, nicknamed PHP2Shell, were leaked ahead of schedule on October 20, 2026. The PHP team moved its security release up by a day, shipping fixes on October 21. Both flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 under CVSS v4.0 and can let an unauthenticated attacker run code on a vulnerable web server via a crafted HTTP request. They stem from memory handling during request setup and cleanup, so they exist below application code and are not fixed by updating apps like WordPress alone. CISA lists affected configurations including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with mod_php considered the highest risk.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DevFest Central Valley in Modesto Centers Community and a Small-Business Accessibility Buildathon

Modesto Mayor Sue Zwahlen opened the second DevFest Central Valley by urging developers, students, and curious residents to get involved, emphasizing community over technical detail. Hosted by several local Google Developer Groups under the theme Build. Scale. Secure., the event included talks, labs, a scavenger hunt, and a short buildathon. Keynote speaker Saphonia Foster framed AI as a community institution and offered a framework built on time, voice, and value. The author used the buildathon to create Onceover, a Gemini-powered tool in Google AI Studio that gives small business owners a first-look accessibility check for their websites.

0 comments Read more at DEV Community