[−]weird-eye-issue · 2026-11-15 Sun 04:10 UTC ·
link
There is nothing wrong with this. It's no different from unauthenticated API routes to get public information. The issue is when somebody doesn't use RLS correctly.
You have called out the issue precisely! The problem is that Supabase, and Lovable, market this product to people who are basically guaranteed to not know how to use RLS correctly. And that the defaults set are insecure - precisely because they know that if they set the security settings to be secure by default, that their end users would churn because... they don't know how to configure RLS. Then they turn around and say "Well, it's YOUR fault if you didn't know how to configure it properly, even though we marketed this to you as being approachable as a layman"
If I had a multi tool that I sold to the masses that required solving a simple math proof to operate or else there was a chance the product would explode in my hand, would it be my fault or the customers fault if it started exploding in the customer's hands, because I marketed it to everyone instead of just mathemeticians, and included no warning label? I can't require that people solve the math proof first and show they can solve math proofs in order to use the product because then they'll just return the product, because the vast majority of people I'm marketing to... can't solve math proofs.
I do, however, have an easy solution here! I can bury "user operates the multi tool at their own risk" in the T&C and now all sorts of hand explosions can happen and it's not my fault!
True, but I've seen staff+ level developers get bit by this. What hope do vibe coders have?
If I had a multi tool that I sold to the masses that required solving a simple math proof to operate or else there was a chance the product would explode in my hand, would it be my fault or the customers fault if it started exploding in the customer's hands, because I marketed it to everyone instead of just mathemeticians, and included no warning label? I can't require that people solve the math proof first and show they can solve math proofs in order to use the product because then they'll just return the product, because the vast majority of people I'm marketing to... can't solve math proofs.
I do, however, have an easy solution here! I can bury "user operates the multi tool at their own risk" in the T&C and now all sorts of hand explosions can happen and it's not my fault!