Supabase to stop exposing new public tables via Data API by default from October 30

·1 views

Starting October 30, 2026, Supabase will apply a new default to existing projects, meaning newly created tables in the public schema will not be reachable through the Data API until access is explicitly granted. New projects have followed this behavior since May 30. Existing tables will keep their current permissions, and row-level security remains a separate requirement alongside grants. Direct Postgres connections and other schemas are unaffected by the change. The article warns that quick fixes to the resulting 'permission denied' errors, such as broad bulk grants or copying the suggested hint without review, can reopen tables to unintended access.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

PaperPilot Uses Gemma to Turn Messy GST Invoices into Clean Records

PaperPilot is an invoice and expense assistant built for freelancers, consultants, and small agencies that struggle with folders of PDF invoices at tax time. The app uses Gemma, Google's open-weight model accessed through the Gemini API, to extract vendor details, dates, GST amounts, and totals from digital PDFs. Its validation layer checks the AI's output, flagging mismatched totals, invalid GSTINs, and unequal CGST and SGST values for human review. Duplicate detection, overdue flags, and bank statement matching are handled with ordinary code rather than AI, and personal identifiers are redacted before any text is sent to the model. Because Gemma's weights are public, the same model could later be self-hosted by users who need full control over their data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most copy-paste HTML contact forms from top search results fail to deliver messages

A developer who builds a form backend checked nine HTML contact form snippets from leading search results on 13 October 2026 by reading their code without submitting anything. Only five would send a message anywhere, and three of those come from form-backend companies, leaving just one independent snippet that delivers a message as pasted. None of the nine set autocomplete attributes or included spam protection in the code itself. Several other snippets had defects such as missing field names, unclosed tags that hid the submit button, or actions that pointed nowhere. The author noted that three of the four non-sending forms never informed the reader of this limitation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Encrypted Connections Alone Failed to Keep an Election Results Portal Online

A county team found that standard TLS encryption did not protect their election-night reporting portal from overload during a stress test. Valid encrypted handshakes were handled easily by edge proxies, but the API layer buckled under complex precinct-level queries at high concurrency. To counter this, engineers added application-level rate limiting, strict query complexity caps, and pre-rendered fallback pages for peak periods. The experience led them to argue that civic systems should be designed to degrade gracefully rather than collapse under load.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Approval Gate Design for Controlling AI Agent Autonomy in TypeScript

A developer explains that an AI agent with a destructive tool can act on a loosely worded prompt, because the missing piece is a rule governing when a tool may run. The author proposes a five-level autonomy scale, from no tools to full autonomy, which is enforced in code rather than set by the model. Autonomy is assigned per tool according to risk: read-only, reversible writes, or irreversible actions such as deleting data. A flowchart and a TypeScript example show how a decision function either runs a tool, asks a human for approval, or refuses it. The post notes that no standard defines these levels and presents the scale as the author's own working framework.

0 comments Read more at DEV Community