[−]reassess_blind · 2026-11-15 Sun 06:10 UTC ·
link
The core issue is how easy it is to misconfigure Supabase (much like Firebase) due to the data security relying on RLS policies. It's such a poorly designed system and so easy to get wrong, and it's clear here that Lovable's AI generator is getting it wrong.
Even when you do get Supabase's RLS policies correct, Supabase still doesn't offer a way to rate limit these tables. i.e Even if the data is secure, an attacker can overwhelm the database instance with big query in a simple for-loop and it's a constant source of issues in the Supabase Discord. There's no server in between that can enforce any rate limits. The whole "query the database from the client" has so many security pitfalls.
Even when you do get Supabase's RLS policies correct, Supabase still doesn't offer a way to rate limit these tables. i.e Even if the data is secure, an attacker can overwhelm the database instance with big query in a simple for-loop and it's a constant source of issues in the Supabase Discord. There's no server in between that can enforce any rate limits. The whole "query the database from the client" has so many security pitfalls.
There are many BAD databases, choosing the wrong one still makes the owner responsible.