Hacker News

Favorites Setup
Comment by steve-chavez | original | Lovable apps expose passport details and more than 200K private messages
[−]steve-chavez · 2026-11-15 Sun 01:20 UTC · link
The hint is not a problem if you use the PostgreSQL default of deny for every table, Supabase is migrating to this default https://github.com/orgs/supabase/discussions/45329. If the defaults are in place even if you see the table name on the hint it will be inaccessible (fails immediately before RLS checks).

Note that the hint is added by PostgREST and it was introduced at a time where users manually typed table names, causing them to report malfunctions on typos. These hints are not as necessary anymore so they're usually disabled via config[1] and will likely be dropped on a next version.

[1]: https://docs.postgrest.org/en/v16/references/configuration.h...