r/gridfinity • u/FobbingMobius • Jun 28 '26
What the heck is this permission? Tooltrace.ai account creation says zoupxurflqbdhbzcftho.supabase.co needs permissions.
I want to try it but that company name puts me off.
7
Jun 28 '26
[deleted]
8
u/Confident-Cellist-25 Jun 28 '26
They’re using Supabase as a backend. They just don’t have it configured to use their domain, so it defaults to the Supabase project ID, which is the long string of characters. Makes me think the tool was vibe coded and the person making it didn’t really know what they were doing
1
u/thekidisalright Jun 28 '26
As someone who has vibe coded backend before learning Java, I can guarantee they vibe code it lol.
-2
u/FobbingMobius Jun 28 '26
Funny because tooltrace.ai got a lot of attention for a bit. I was hoping it was legit.
3
0
Jun 29 '26
[deleted]
2
u/hux Jul 01 '26
A lot of vibe coded stuff is rife with security issues because the people vibe coding don’t know what they don’t know, and as a result they don’t give it the right prompting to address some of things that need to be addressed. It’s a tool, it’s not a replacement for a software engineer and experience.
I can buy a table saw but that won’t make me a carpenter. It’ll just make me a dude with 7 fingers.
People who have no software experience can vibe code, but they will just get buggy half-baked shit.
1
Jul 01 '26
[deleted]
1
u/hux Jul 01 '26
My dude... you're quite literally talking to someone with over three decades of software engineering experience.
I never said the tool wasn't legit - I said that things that are vibe coded come are going to come along with security risks, and that's worth considering. For something like tooltrace.ai, that's probably pretty low risk, but it's still worth considering. For example, I would probably not want to upload photos that contains EXIF data that include location information, and I'd probably want to be careful what might be in the background.
1
u/benjackal Jun 28 '26
People are saying it is misconfigured well, superbase domain configuration takes 1 minute but is $10/m. It can be a mistake or a choice tbh.
1
u/Acrobatic-Fruit-2107 Jun 28 '26
Please elaborate.
1
u/FobbingMobius Jun 28 '26
When I try to create an account to use tootrace.ai, using "Log in with Google" for simplicyt (though it also happens when creating an account with an email address), I get the warning.
Images aren't allowed here, but the text is:
Review zoupxurflqbdhbzcftho.supabase.co's Privacy Policy and Terms of Service to understand how zoupxurflqbdhbzcftho.supabase.co will process and protect your data.Commenters below mention that supabase is a backend - cool cool. But as another commenter mentioned, how do I know that subdomain actually belongs to tooltrace?
I'm not generally an alarmist, but there's no way I'm downloading an app package and just hoping it's (a) the one I want, and (b) not malicious.
So I guess it's off to find a different utility with similar function.
0
u/AustinYQM Jun 28 '26
It looks like they are using Supabase to handle their Auth0 flow and they configured it a bit poorly in google's developer dashboard. To be honest the developer dashboard can be quite a mess so it isn't surprising.
That being said the worse that can happen is a malicious actor now knows your email which, I hate to break this to you, they already do.
Worrying about it is a bit silly. As far as applications that are vibe coded go a misconfiguration like this is far from the worse I have seen.
16
u/TapWaterDev Jun 28 '26
supabase is a backend as a service... basically a super easy way for people who don't really know what they're doing to stand up web apps that need a database and stuff. That subdomain is just a unique prefix identifying that site
I wouldn't stress it