Hacker News new | ask | show | jobs
by xytofs 791 days ago
> how are your security teams ok with exposing your PG server to the internet, relying mainly on RLS? And RLS isn't turned on by default, so full tables are exposed to the public internet by default, behind a rather nice REST API.

Tooling is improving constantly and security really is at the top of mind for us. We've got some cool announcements this week that will keep reminding you if you're doing something sketchy!
2 comments
atonse 791 days ago
Good to hear, thanks.

I really am trying to provide constructive criticism (even if my tone is not great because the pain I'm continuing to feel with the platform is still fresh).

I do think you guys are in a great position to actually improve all that tooling around RLS. Tools that can analyze your policies, that can visually map the recursive nature of policies that run, etc.

link
omnibrain 791 days ago
An access-simulator where you can check if a user (or anon) has some type of access would be helpful.
link
kiwicopple 791 days ago
we actually have this:

https://supabase.com/blog/studio-introducing-assistant#user-...

and you can expect to see another related launch this week with some more in-depth tooling:

https://github.com/supabase/splinter

link