Back
Chamarti Sreekar
Passionate about Pos... • 1m
You shipped your Supabase app. Everything runs smooth... until it doesn’t. Not because Supabase is broken — But because it’s too easy to use. And that ease hides traps. Here are 6 mistakes that quietly wreck Supabase apps (and how to avoid them): 🔒 1. Trusting auth.user() in the frontend It’s not safe. It’s client-side and spoofable. Use server-side checks with RLS and JWT claims. Always. 🔓 2. Public tables with no RLS Querying is easy, but security is optional. Default to RLS ON, then explicitly open what needs access. 😵 3. No fallback in auth.uid() Policies depending only on auth.uid() fail silently during admin queries. Always account for IS NULL. ⚠️ 4. Splitting auth state between client and app Session state in two places = race conditions. Let Supabase handle it. React to onAuthStateChange() once — in one place. 🧩 5. Calling edge functions without auth context Edge functions don’t carry auth by default. Pass the Authorization header manually — no header = no user. 👻 6. Testing only as a logged-in user Your app works for you. What about anonymous users? Test unauthenticated access too — Supabase doesn’t block anon by default. Supabase is powerful, but that power cuts both ways. Don’t treat it like Firebase. Treat it like backend infra: Secure by default Test like a hacker Trust nothing by default Build fast — but build like it’ll scale. Because one silent failure can kill momentum.
Replies (8)
More like this
Recommendations from Medial
Avinash Bhardwaj
Building launch.toda... • 13d
Launch’s Launch Alert 🚀 Excited to share that Launch is now live. We’ve spent the last few months building something that feels obvious in hindsight: A way to build real, production-ready apps- just by describing what you want. ✅ Real human support
See More
Poosarla Sai Karthik
Tech guy with a busi... • 3m
Sales is treated like a shitty job globally—because it’s rarely treated as a real role. Most startups don’t even have a dedicated sales person. They assume anyone can pick up a phone and sell. Even when they hire, it’s like: “Here’s a guy from the r
See More
Srijeet Singha
• Founder of Arbesha... • 2m
Struggling to land your first client online? Here’s EXACTLY how I did it at 15 from my room. 🧠 Use just ONE free AI tool 💼 Solve a real problem 💰 Get paid internationally 📍 No website,portfolio Just results Client was flooded with 100+ resumes
See More
Siddharth K Nair
Thatmoonemojiguy 🌝 • 3m
When a Brand Name Becomes the Language You don’t search, you Google. You don’t buy adhesive, you grab Fevicol. You don’t ask for toothpaste, you ask for Colgate — even if it’s not Colgate. This is what marketers dream of: Becoming the noun. The act
See More
Download the medial app to read full posts, comements and news.