[−]claytongulick · 2026-11-15 Sun 04:07 UTC ·
link
RLS can be really tricky to get right, even for an experienced developer.
It's one of the reasons I've avoided supabase (and postgrest) because I've found any non-trivial security implemented via RLS to be a lot more difficult to implement, audit and test than equivalent middleware in express, for example.
I think it's going to be a pretty tall order to expect AI systems to nail this, as it requires quite a bit of reasoning and business domain expertise- the things that LLMs are notoriously bad at.
We are training our agent and models to get really good at RLS. A lot of projects mentioned in the research are created with older models, unfortunately. Which means, a worse starting point compared to where the models are today. Yet, they have access to latest scanners which are also optimized and trained on good and bad RLS outcomes.
Our ask today is to click Free Fix and do not ignore warnings (incl email and in-app notifications to builders). Enabling auto-fix is another great way to decrease risk of your app.
Also, soon we will have gates against publishing of anything with Critical issues in it, available to all tiers.
It's one of the reasons I've avoided supabase (and postgrest) because I've found any non-trivial security implemented via RLS to be a lot more difficult to implement, audit and test than equivalent middleware in express, for example.
I think it's going to be a pretty tall order to expect AI systems to nail this, as it requires quite a bit of reasoning and business domain expertise- the things that LLMs are notoriously bad at.