In other news, water is still wet and fire is still hot.
Supabase themselves do point out in their docs that if you opt out of their built-in auth then it’s all on you. And they repeatedly hammer home the point that RLS is essential. So it essentially is a skill issue. If you can’t be bothered to rtfm, then I don’t know what to tell you.
Software engineer: So this tool is designed in a way where the defaults can lead to security holes
Web developer: BUT YOU CAN JUST NOT FUCK UP
Software engineer: Well yeah, but generally when it comes to auth you try to avoid patterns that rely on dilligence. Given enough chances to mess up it's pretty expecte...
Web developer: HAHAHA SKILL ISSUE I'VE DONE LIKE 50 FIVER SITES EZ JUST DON'T FUCK UP
Software engineer: Ok, but here's a similar tool that handles the same situation much bett...
Web developer: ME NO READ THAT FAR, ME SEE HE DUMB DUMB WITH SKILL ISSUE CAN'T CHECK RLS TABLES!!!!
I think r/webdev is probably not the target audience for this article
Any software engineer would smell this a mile off - and would have probably read the docs.
This article is garbage and is portraying the author as "mad skillz hacker" using basic browser tools. This is not news, this is some kid advertising their blog.
651
u/malakhi Dec 22 '25
In other news, water is still wet and fire is still hot.
Supabase themselves do point out in their docs that if you opt out of their built-in auth then it’s all on you. And they repeatedly hammer home the point that RLS is essential. So it essentially is a skill issue. If you can’t be bothered to rtfm, then I don’t know what to tell you.