Supabase RLS Leak Demo
Reproduce a cross-tenant RLS leak and verify the fix
Supabase RLS Leak Demo launched on August 8, 2026.
What it does
A tiny, runnable Supabase/Postgres security fixture that proves a policy can look correct and still leak rows across tenants. The same test suite runs red on the broken policy and green after the one-file fix. Start with npm ci && npm test—no Docker, cloud project, credentials, or production data required. Built for founders and developers who want evidence before shipping multi-tenant apps.
A reproducible Supabase row-level-security data leak and its one-file fix. Same test suite: red on `broken`, green on `fixed`. Runs with npm ci && npm test — no Docker, no cloud project, no credentials. - cekuu35/supabase-rls-leak-demo
Want the audit/rls-audit.sql (9 queries) + audit/two-user-probe.sql + the RLS Test Matrix as a copy-pasteable markdown file — without digging through the repo? No spam. One email with the files. Unsubscribe anytime. Also adds you to the Gumroad "follow" list for updates. This repository is a synthetic minimal reproduction of a missing-RLS configuration in a PostgreSQL schema designed for Supabase-style auth. The branches use the same tests and differ only by db/policies.sql . It is not an export from, or evidence about, any named AI/no-code tool. npm ci npm run test:ci No Docker, Supabase project, or credentials are required. The tests run PostgreSQL in PGlite and exercise database-level…from github.com
Does a similar job
all alternatives →
Supabase-Test – Fast Isolated Postgres DBs for Testing Supabase RLSNov 2025 · npmjs.com · ▲30Hi HN — we've built a testing framework for Supabase that spins up fast, isolated Postgres databases for each test case. It’s designed to make RLS policies easy to validate with real database state, without global test fixtures or mock auth. Features: - Instant isolated Postgres DBs per test - Automatic rollback after each test - RLS-native testing with `.setContext()` for auth simulation - Flexible seeding (SQL, CSV, JSON, JS) - Works with Jest, Mocha, and any async test runner - CI-friendly (runs cleanly in GitHub Actions) We also published example projects and a free set of tutorials:…
- MDMultiplayer Demo Built with Elixir2022 · multiplayer.dev · ▲221
Hey HN, I’m an engineer at Supabase [0] and one of the creators of this demo. My team and I have been working hard to bring developers the next version of Supabase Realtime. The current version of Realtime [1] is a Change Data Capture (CDC) server for a PostgreSQL database that broadcasts changes via WebSockets to authorized subscribers. It’s written in Elixir/Phoenix. The server utilizes PostgreSQL’s logical replication functionality, which writes database changes to Write-Ahead Logging (WAL) segment files, and a replication slot, responsible for managing and retaining WAL files.…
Pg_CRDT – an experimental CRDT extension for Postgres2022 · supabase.com · ▲296This is an experimental extension for CRDTs, pg_crdt: GitHub repo[0]. It supports Yjs/Yrs and Automerge. The linked blog post [1] describes how we're thinking about this extension in a Supabase context. I want to emphasise this part: "pg_crdt has not been released onto the Supabase platform (and it may never be). We’re considering many options for offline-sync/support and, while CRDTs will undoubtedly factor in, we’re not sure if this is the right approach." [0] GitHub repo: https://github.com/supabase/pg_crdt [1] Blog post:…
Pg_replicate – Build Postgres replication applications in Rust2024 · github.com · ▲216A high-performance Postgres replication engine written in Rust. Embed it in your Rust application or run it as a standalone binary. - supabase/etl
LeakScope — Supabase Security AuditorMar 2026 · leakscope.tech · ▲3Scan websites for exposed Supabase data and API leaks
Open source, logical multi-master PostgreSQL replication2025 · github.com · ▲151Logical multi-master PostgreSQL replication. Contribute to pgEdge/spock development by creating an account on GitHub.
More dev tools this month
the category →
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 28d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 26d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 23d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 21d ago · talanoa.email
CoreSpeed▲332One MCP for everything your agents need: apps, memory, tools
Dev tools · 28d ago · corespeed.io
Source: Product Hunt launch ↗
Launched alongside, August 2026
the whole month →- TL
Life & fun · Aug 2026 · louisabraham.github.io
Clipto MCP▲655Hey HN, We recently built Clipto. It’s a tool that lets you search over terabytes of video, audio, and images on your computer, without relying on the cloud. Motivation: we probably all had this similar experience, we know a moment exists in a video or audio, but finding it takes hours scrubbing the timeline. You can send all the media to process in the cloud, but it’s slow, expensive and raises privacy concerns. So we decided to build our own on-device media search engine. How it works (high level): 1. We ingest video, audio, image; normalize formats via ffmpeg; run content analysis to…
Work · Aug 2026 · clipto.com
Hello HN! I found that picking out plausible but diverse skin tones for my digital art and game development projects was kind of difficult, and I got curious about if there was a way to define a color space that made it easy. I've built a color picker and procedural generation algorithm based on the space as well as a bunch of other fun js features and demos throughout the page that use the equations. If you find it interesting, I have lots of explanations of how I built it and what properties the space has. The methodology might be a bit shaky, but hopefully the result is as helpful for…
Life & fun · Aug 2026 · toneyalexander.github.io
Astute▲606Automate your B2B brand going viral, with new media creators
AI · Aug 2026 · company-app.joinastute.com