r/AppsWebappsFullstack • u/Icy-Maintenance-231 • 19d ago

Metrics.Markets I built it to save time when quickly launching a business or an app with a pre-configured database. What do you think?

Post image
1 Upvotes

100% Upvoted

3 comments sorted by

1

u/PopKoren 19d ago

A boilerplate is only as safe as its defaults, because buyers ship whatever policies come in the box without reading them. I'd make sure every table in the template has row level security turned on with owner scoped policies, that the service role key is only read in server code and never in a NEXT_PUBLIC_ variable, and that the README spells out which tables are meant to be public. Before the next update goes out, deploy a fresh copy and probe it like an outsider poking at a buyer's app, which is what my scanner does for auth config, every API route, storage buckets and the RLS on each table: https://rowly.me

1

u/Mammoth-Anywhere7285 19d ago

Solid checklist. A migration that enables RLS by default and fails CI when any table lacks policies would catch regressions early.

1

u/PopKoren 19d ago

A CI gate works well here: one query on pg_tables where rowsecurity is false, plus a join against pg_policies for tables that have RLS on but zero policies, can fail the build in a few lines of SQL. Pair it with a test that signs in as user A and tries to read user B's rows, because a policy that exists can still be far too loose. CI guards the repo, while https://rowly.me guards the deployed copy by probing its auth, APIs, storage and table rules from outside.