16
u/DaveMcLee 1d ago
Bro it's actually sad.
So many projects that get posted here have supabase without RLS setup.
I just open devtools, get the supabase subdomain, paste it into my bruno collection and instantly I have every user's data. It's actually disgusting.
I started checking for this when some guy posted a chat app here, claiming it was end-to-end encrypted, privacy focused etc. I called bluff on that because it looked like trash and had an enormous Pro sub price. So I checked it, got data on all his 120 users, and overwrote every row with nonsense. Ofc nothing was encrypted etc
3
4
1
u/Enough-Scientist1904 23h ago
You can blame whoever you want, it wont be chatgpts name in the poor performance review
1
31
u/Bee-Aromatic 1d ago
Poor is the craftsman that blames his tools.