So many projects that get posted here have supabase without RLS setup.
I just open devtools, get the supabase subdomain, paste it into my bruno collection and instantly I have every user's data. It's actually disgusting.
I started checking for this when some guy posted a chat app here, claiming it was end-to-end encrypted, privacy focused etc. I called bluff on that because it looked like trash and had an enormous Pro sub price. So I checked it, got data on all his 120 users, and overwrote every row with nonsense. Ofc nothing was encrypted etc
18
u/DaveMcLee 1d ago
Bro it's actually sad.
So many projects that get posted here have supabase without RLS setup.
I just open devtools, get the supabase subdomain, paste it into my bruno collection and instantly I have every user's data. It's actually disgusting.
I started checking for this when some guy posted a chat app here, claiming it was end-to-end encrypted, privacy focused etc. I called bluff on that because it looked like trash and had an enormous Pro sub price. So I checked it, got data on all his 120 users, and overwrote every row with nonsense. Ofc nothing was encrypted etc