Hacker News

Favorites Setup
Comment by neathack | original | Lovable apps expose passport details and more than 200K private messages
[−]neathack · 2026-11-14 Sat 19:31 UTC · link
While we’re at it, I was quite surprised to discover that Supabase leaks schema information through the `hint` field in error messages:

https://docs.postgrest.org/en/latest/references/errors.html

For example, if you try to access a table named "secret" that doesn’t exist, Supabase might return a hint saying, "Perhaps you meant the table 'public.super_secret'."

Thanks for volunteering that information, I guess.

[−]doctorpangloss · 2026-11-14 Sat 21:56 UTC · link
nobody needs supabase.
[−]steve-chavez · 2026-11-15 Sun 01:20 UTC · link
The hint is not a problem if you use the PostgreSQL default of deny for every table, Supabase is migrating to this default https://github.com/orgs/supabase/discussions/45329. If the defaults are in place even if you see the table name on the hint it will be inaccessible (fails immediately before RLS checks).

Note that the hint is added by PostgREST and it was introduced at a time where users manually typed table names, causing them to report malfunctions on typos. These hints are not as necessary anymore so they're usually disabled via config[1] and will likely be dropped on a next version.

[1]: https://docs.postgrest.org/en/v16/references/configuration.h...