RLS enabled isn't proof: how do you verify Supabase privacy after every migration?
Real_KingZeotic · reddit · 2026-10-02
A developer asks how to prove Supabase data stays private as AI agents keep adding tables and migrations. "RLS enabled" in the dashboard is a status, not evidence — past leaks involved anon users reading whole tables, service keys bundled in frontends, and policies left as true.
His current workflow is manually curling tables as anon, which is tedious and error-prone. He's looking for tools or repos that retest anon and wrong-user access after every migration and ideally block deploys when a table opens up, rather than alerting after the fact.
More from coding & agent
- AI rewrites France's AROME weather model from scientific papers in four days — capetorch · 2026-10-02
- Gemini CLI hits dead end for individuals as Google pushes migration to Antigravity — Daniel_Farinax · 2026-10-02
- What should make you walk away from a voice-agent pilot? False confirmations — Legitimate-Pride-685 · 2026-10-02
- Users: new Gemini shines on open-ended overnight research tasks, Flash covers daytime — JMateosGarcia · 2026-10-02
- Claude Code Desktop Lets You Pop Diffs and Terminal Panes Out to a Second Screen — EricBuess · 2026-10-02
- AI agents play The Traitors UK in parallel: a 30-day emergent-behavior sim — bobo-the-merciful · 2026-10-02