prisma-firewall

What it does

Every Prisma developer has a silent risk in their codebase. A single deleteMany() with no where clause wipes an entire table. A findMany() with no limit dumps your entire database to the client. And there's a lesser known attack called operator injection, where an attacker sends { "not": "" } as a password value instead of a plain string, and Prisma accepts it as a valid query operator, bypassing authentication entirely. When tested, Prisma did not block it. prisma-firewall does.

A security firewall for Prisma that blocks dangerous queries before they hit your database. Prevents deleteMany without where clauses, operator injection attacks, sensitive field exposure, and more. - CodesByNeeraj/prismafirewall

A security firewall for Prisma. Blocks dangerous queries before they hit your database. await prisma . user . deleteMany ( ) Or this returns every user in your database — passwords, tokens, sensitive fields — to whoever called it: await prisma . user . findMany ( ) These aren't hypothetical risks. They happen from bugs, tired developers, bad inputs, and compromised dependencies. prisma-firewall sits between your code and your database and stops them before they cause damage. import { PrismaClient } from '@prisma/client' import { withFirewall } from 'prisma-firewall' const baseClient = new PrismaClient ( ) export const prisma = withFirewall ( baseClient , { rules : { blockDeleteWithoutWhere…from github.com

• 
  Prisma2018 · prisma.io · ▲522

  Build a GraphQL server with any database

• 
  Prisma Postgres2025 · prisma.io · ▲262

  The future of serverless databases

• 
  Hiding code from Git diff2017 · twistlock.com · ▲167

  Prisma Cloud is the most complete Cloud Native Application Protection Platform (CNAPP) for code to cloud security in any cloud, multicloud, and hybrid environment.

• 
  Prisma ORM2021 · prisma.io · ▲220

  Next-generation ORM for Node.js and TypeScript

• 
  Prism – Let browser agents access any app2025 · prismai.sh · ▲21

  Hey HN, We’re Alex, Land, and Rajit. We’re building Prism (prismai.sh), a tool that helps browser agents authenticate onto websites with user credentials. Developers pass in credentials, Prism logs into a website on their behalf, and hands them back the cookies so they have an authenticated session. Here’s an example of how developers can use Prism to complete username/password flows (https://youtu.be/SEtVUnWnxuE), and here’s an example of how developers can use Prism to complete login flows that require an OTP code (https://youtu.be/fe9w9PvrwH0). We spoke…

• 
  Type-safe Go database client for Postgres, MySQL and SQLite2020 · github.com · ▲12

  Prisma Client Go is an auto-generated and fully type-safe database client - steebchen/prisma-client-go

• 
  /dev/null▲487

  a social network for devs

  Dev tools · 3d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 28d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 26d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 23d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 21d ago · talanoa.email

• 
  CoreSpeed▲332

  One MCP for everything your agents need: apps, memory, tools

  Dev tools · 28d ago · corespeed.io

• 
  Brila▲1,364

  One-page websites from real Google Maps reviews

  AI · Apr 2026 · brila.ai

• AG
  A game where you build a GPU▲964

  Thought the resources for GPU arch were lacking, so here we are

  Life & fun · Apr 2026 · jaso1024.com

• 
  I built a tiny LLM to demystify how language models work▲915

  Built a ~9M param LLM from scratch to understand how they actually work. Vanilla transformer, 60K synthetic conversations, ~130 lines of PyTorch. Trains in 5 min on a free Colab T4. The fish thinks the meaning of life is food. Fork it and swap the personality for your own character.

  AI · Apr 2026 · github.com

• 
  Fathom 3.0▲800

  AI meeting notes: now bot-free, in ChatGPT & Claude + more

  AI · Apr 2026 · fathom.ai

• 
  Brutalist Concrete Laptop Stand (2024)▲786

  I made a laptop stand out of solid concrete, in the style of brutalist architecture, with themes of urbex and urban decay

  Life & fun · Apr 2026 · sam-burns.com

• 
  I built a frontpage for personal blogs▲783

  With social media and now AI, its important to keep the indie web alive. There are many people who write frequently. Blogosphere tries to highlight them by fetching the recent posts from personal blogs across many categories. There are two versions: Minimal (HN-inspired, fast, static): https://text.blogosphere.app/ Non-minimal: https://blogosphere.app/ If you don't find your blog (or your favorite ones), please add them. I will review and approve it.

  AI · Apr 2026 · text.blogosphere.app