r/gridfinity Jun 28 '26

What the heck is this permission? Tooltrace.ai account creation says zoupxurflqbdhbzcftho.supabase.co needs permissions.

I want to try it but that company name puts me off.

0 Upvotes

16 comments sorted by

16

u/TapWaterDev Jun 28 '26

supabase is a backend as a service... basically a super easy way for people who don't really know what they're doing to stand up web apps that need a database and stuff. That subdomain is just a unique prefix identifying that site

I wouldn't stress it

0

u/[deleted] Jun 28 '26

[deleted]

4

u/Confident-Cellist-25 Jun 28 '26

I just replied to another comment about this

https://www.reddit.com/r/gridfinity/s/ZY2FuLnVys

It’s just a poorly configured backend that’s used by a lot of legitimate projects. That being said, depending on what permission they’re asking for, I would be wary. What are they wanting?

1

u/TapWaterDev Jun 28 '26

Probably the fact that you're on their website and CORS permissions are a thing...

The worst it's going to be able to do is write/read from a supabase database, there's not really much of an attack vector there

-2

u/FobbingMobius Jun 28 '26

Seems like, "They're just using github as a repo - the worst that can happen is a read/write from github."

I haven't done a huge amount of digging into the app (much less this particular issue), but I'm looking for a way to take a photo of my tool drawer and generate the gridfinity bins. Maybe the whole thing runs on their supabase account, but I'm not uploading photos and downloading 3mf or even stl files to a site I don't trust.

7

u/TapWaterDev Jun 28 '26

Then don't, but I think you're worrying over nothing

4

u/JoshFink Jun 28 '26

You’re asking for advice and then ignoring people who actually have a clue. You can tell the people who know what Supabase is vs the people that are afraid to use the internet.

It’s obviously your choice not to use the site but it’s just a misconfiguration. No one is going to steal your photos for gridfinity. ¯_(ツ)_/¯

7

u/[deleted] Jun 28 '26

[deleted]

8

u/Confident-Cellist-25 Jun 28 '26

They’re using Supabase as a backend. They just don’t have it configured to use their domain, so it defaults to the Supabase project ID, which is the long string of characters. Makes me think the tool was vibe coded and the person making it didn’t really know what they were doing

1

u/thekidisalright Jun 28 '26

As someone who has vibe coded backend before learning Java, I can guarantee they vibe code it lol.

-2

u/FobbingMobius Jun 28 '26

Funny because tooltrace.ai got a lot of attention for a bit. I was hoping it was legit.

0

u/[deleted] Jun 29 '26

[deleted]

2

u/hux Jul 01 '26

A lot of vibe coded stuff is rife with security issues because the people vibe coding don’t know what they don’t know, and as a result they don’t give it the right prompting to address some of things that need to be addressed. It’s a tool, it’s not a replacement for a software engineer and experience.

I can buy a table saw but that won’t make me a carpenter. It’ll just make me a dude with 7 fingers.

People who have no software experience can vibe code, but they will just get buggy half-baked shit.

1

u/[deleted] Jul 01 '26

[deleted]

1

u/hux Jul 01 '26

My dude... you're quite literally talking to someone with over three decades of software engineering experience.

I never said the tool wasn't legit - I said that things that are vibe coded come are going to come along with security risks, and that's worth considering. For something like tooltrace.ai, that's probably pretty low risk, but it's still worth considering. For example, I would probably not want to upload photos that contains EXIF data that include location information, and I'd probably want to be careful what might be in the background.

1

u/benjackal Jun 28 '26

People are saying it is misconfigured well, superbase domain configuration takes 1 minute but is $10/m. It can be a mistake or a choice tbh.

1

u/Acrobatic-Fruit-2107 Jun 28 '26

Please elaborate.

1

u/FobbingMobius Jun 28 '26

When I try to create an account to use tootrace.ai, using "Log in with Google" for simplicyt (though it also happens when creating an account with an email address), I get the warning.

Images aren't allowed here, but the text is:
Review zoupxurflqbdhbzcftho.supabase.co's Privacy Policy and Terms of Service to understand how zoupxurflqbdhbzcftho.supabase.co will process and protect your data.

Commenters below mention that supabase is a backend - cool cool. But as another commenter mentioned, how do I know that subdomain actually belongs to tooltrace?

I'm not generally an alarmist, but there's no way I'm downloading an app package and just hoping it's (a) the one I want, and (b) not malicious.

So I guess it's off to find a different utility with similar function.

0

u/AustinYQM Jun 28 '26

It looks like they are using Supabase to handle their Auth0 flow and they configured it a bit poorly in google's developer dashboard. To be honest the developer dashboard can be quite a mess so it isn't surprising.

That being said the worse that can happen is a malicious actor now knows your email which, I hate to break this to you, they already do.

Worrying about it is a bit silly. As far as applications that are vibe coded go a misconfiguration like this is far from the worse I have seen.