1. Blame the user because they didn't verify the app they built on your infrastructure meets the most basic requirements?
2. Then provide a tool that offers no guarantees and no definitions of what critical vs non-critical means.
3. And put the extra onus on users to run a "deep" scan when they intuit (somehow?) that there might be problems for which there is no hint?
4. All while telling users that critical issues are really bad but normal issues are... ok? I have no idea what they are from your writeup.
5. While selling better security for business and even better security for enterprise. Because security for everyone else isn't important!?
Is this supposed to be a roadmap to security antipatterns?
It's so interesting how you've created a nice ecosystem where you're not responsible for the security problems but at the same time your users are meant to trust you to take care of that. We really need to change the laws around this.
I see it as an opportunity to educate the builder community on importance of using the provided security tooling. What I'm asking users is to use tools while building. Our tools explain security in business terms and give people tools to bridge the technical gap. Is it always enough? No, there's no perfect tool or approach, there will always be space to improve. But as you can see, if apps continue to expose the data, the actual blame falls on us - and there's no intention to say. And we are taking it as an input to improve our tools, UX, auto-fix tooling, user messaging and have more ways for users to build secure apps.
I find this theory really odd. Wouldn't it make more sense to flip it around and have it maximally locked down from the beginning? You're providing essentially a Supabase abstraction. Why not make the abstraction secure from the beginning?
1. Blame the user because they didn't verify the app they built on your infrastructure meets the most basic requirements?
2. Then provide a tool that offers no guarantees and no definitions of what critical vs non-critical means.
3. And put the extra onus on users to run a "deep" scan when they intuit (somehow?) that there might be problems for which there is no hint?
4. All while telling users that critical issues are really bad but normal issues are... ok? I have no idea what they are from your writeup.
5. While selling better security for business and even better security for enterprise. Because security for everyone else isn't important!?
Is this supposed to be a roadmap to security antipatterns?
It's so interesting how you've created a nice ecosystem where you're not responsible for the security problems but at the same time your users are meant to trust you to take care of that. We really need to change the laws around this.