It's a shame that making things easy to use has typically meant the user gives up control/hosting capabilities and generally gets less security out of the box. You're probably right about Supabase, that they made that tradeoff explicitly, but they have more demand than they keep up with now and finally seem to be course correcting toward more secure defaults. They apparently believe this will make onboarding their users more difficult (this is a false dilemma IMO).
People who don't get Postgres and RLS implement it sloppily and you inevitably get cases like this. You can put that on the user but I think platforms have a higher bar here to create experiences or interfaces where the easy path is the most secure one. There are obviously other parts of the process that can be leaky beyond beyond just the database config so the app architecture needs to make the system cohere together securely and I just don't feel like the existing platforms are fully up to the task.
The vibecoding tools like Lovable, bolt, v0, replit, base44 don't really attempt to be overtly transparent because that's not the point. They all sell the idea of a concierge service but that only works if the experience is actually "luxury" which in this case means you can trust in a guaranteed basic level of data privacy.
People who don't get Postgres and RLS implement it sloppily and you inevitably get cases like this. You can put that on the user but I think platforms have a higher bar here to create experiences or interfaces where the easy path is the most secure one. There are obviously other parts of the process that can be leaky beyond beyond just the database config so the app architecture needs to make the system cohere together securely and I just don't feel like the existing platforms are fully up to the task.
The vibecoding tools like Lovable, bolt, v0, replit, base44 don't really attempt to be overtly transparent because that's not the point. They all sell the idea of a concierge service but that only works if the experience is actually "luxury" which in this case means you can trust in a guaranteed basic level of data privacy.