SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Supabase Platform Is Secure, but App-Level Table Settings Decide Data Exposure

0
·8 views

A full-stack engineer argues that Supabase's platform security is independently audited, with SOC 2 Type 2 and ISO 27001 certifications, AES-256 encryption at rest, and TLS in transit. The article stresses that data safety depends on the customer's own configuration under Supabase's shared responsibility model, including table grants, row-level security policies, and API key usage. In a local test, the same public key returned zero rows or all three rows depending solely on one table setting. The author points to a 2025 vulnerability that exposed data in 170 of 1,645 showcase apps built on the platform. Supabase has since added safer defaults, including row-level security enabled by default and new grant rules scheduled to take effect on 30 October 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Load Bearing Empire Unifies Six Businesses on One Self-Hosted AI Infrastructure Stack

In March 2026, Load Bearing Empire rolled out a shared AI infrastructure across six separate businesses spanning real estate, demolition, valet services, credit repair, mineral rights, and structural software. The company built the system on Supabase, VAPI voice agents, Asterisk 18.10 telephony, and a custom routing component called the JARVIS Brain Router. It dropped third-party services such as Twilio, SendGrid, and Make.com, aiming to match the cost of legacy platforms while keeping full control over its architecture. The setup runs a single Supabase project with 98 tables and 42 Edge Functions, alongside 26 concurrent VAPI agents and Asterisk call routing hosted on Vultr. The write-up documents the design decisions, integration methods, and lessons learned from consolidating these processes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Celery worker alert: no completed work recorded for 1175 seconds, past 300-second threshold

On October 26, 2026 at 06:20, a 'Worker heartbeat stale' alert fired for a Celery worker, indicating the process was running but not processing work as expected. The last AgentRun was recorded 1175 seconds earlier, nearly four times the 300-second warning threshold. The alert suggested reading logs via docker logs and restarting the worker if it was looping, but the source does not state which action was taken or how the issue was resolved. The cause of the stall is not identified from the alert alone. The author concludes that liveness checks are insufficient and that alerts should track time since the last completed unit of work.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SQL Server Parameter Sniffing: Causes and Fixes for Unstable Query Performance

Parameter sniffing occurs when SQL Server builds and caches an execution plan based on the parameter values passed during a procedure's first run, and then reuses that plan for all later calls. This works well for evenly distributed data but can cause inconsistent slowdowns when data is skewed, such as a few customers with millions of rows and many with very few. The article explains how to spot the problem by comparing estimated and actual row counts or the compiled and runtime parameter values in execution plans. Suggested remedies include forcing a known good plan through Query Store, using OPTION (RECOMPILE) for infrequent queries, and applying OPTIMIZE FOR hints or separate code paths for outlier values. A covering index that makes one plan efficient across all values is presented as a more permanent solution.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Nine AI developer platforms disclosed breaches in October, all targeting stored AI provider keys

Wiz Research's October 30 report counted at least nine AI developer platforms that disclosed security incidents within a single month. The incidents stemmed from different root causes, including credential access, build infrastructure privilege escalation, a vendor dependency, and a legacy system, but all aimed at environment variables holding AI provider keys. Wiz traced one stolen enterprise Amazon Bedrock key to about 1.7 million API calls in thirteen hours, illustrating the financial stakes of such access. The stolen credentials are being used in LLMjacking, where attackers run workloads on others' paid accounts or resell that access. Railway estimated its exposure at up to 1.85% of its workspaces, roughly 100,000, and asked major AI providers to revoke affected keys.

0 comments Read more at DEV Community