Writing

Notes on Bubble.io, AI, and shipping things.

68 posts on Bubble.io, AI, n8n, and shipping production apps that hold up.

How to encrypt API keys and client secrets in Supabase: cover image

Latest

· 7 min read · supabase , supabase-vault , postgres

How to encrypt API keys and client secrets in Supabase

Use Supabase Vault to encrypt API keys and client secrets, keep metadata in Postgres, and gate decrypts behind one checked SECURITY DEFINER function.

Read as a series

Topical clusters meant to be read in order, or jumped into anywhere.

Supabase Production Hardening 7 posts
Read the series
Chrome Extension Lifecycle 3 posts
Read the series
Claude Code Engineering 9 posts
Read the series
Data Pipeline Reliability 4 posts
Read the series

Recent writing

View all 68 →

·6 min read · chrome-extension , github-actions , pre-commit-hooks

Chrome extension version-bump discipline: pre-commit + GitHub Actions

The Chrome Web Store rejects re-uploads with the same manifest version. Catch the missed bump locally in a pre-commit hook; gate it again in CI.

Chrome extension version-bump discipline: pre-commit + GitHub Actions: cover image

·7 min read · chrome-extension , manifest-v3 , supabase

How to build a Chrome extension popup with Supabase Auth (step by step)

Wire Supabase Auth into an MV3 popup: bundle the UMD, persist sessions in chrome.storage, recover state on reopen. Working code included.

How to build a Chrome extension popup with Supabase Auth (step by step): cover image

·10 min read · chrome-extension , manifest-v3 , chrome-web-store

Shipping a Manifest V3 Chrome extension: the gates nobody mentions

Trader verification, publisher identity, the URL slug gotcha, version-bump CI: the async gates that turn a one-day project into a three-week project.

Shipping a Manifest V3 Chrome extension: the gates nobody mentions: cover image

·7 min read · methodology , refactoring , lovable

Phased migrations with per-phase verification gates

Big-bang refactors of 6+ files break things you cannot predict. Phased migration with explicit gates catches regressions before they compound.

Phased migrations with per-phase verification gates: cover image

·8 min read · claude-code , claude-md , lovable

How I document AI-built projects: a CLAUDE.md, ISSUES.md, and prompts/ workflow

Four files that fix the missing context in AI-built codebases: CLAUDE.md, ISSUES.md, a prompts/ folder, and a two-AI handoff workflow.

How I document AI-built projects: a CLAUDE.md, ISSUES.md, and prompts/ workflow: cover image

·7 min read · react-hook-form , zod , react

How to migrate a useState form to React Hook Form and Zod (the real walkthrough)

Step-by-step migration from useState to React Hook Form, Zod, and shadcn Form. Code diffs, validation mode choice, and four gotchas covered.

How to migrate a useState form to React Hook Form and Zod (the real walkthrough): cover image

·7 min read · supabase , supabase-auth , supabase-publishable-key

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.

Supabase publishable keys return 401 from hand-rolled fetch. Migration to @supabase/supabase-js with a chrome.storage.local session adapter.

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.: cover image

·9 min read · lovable , lovable-security , supabase

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook

Audit checklist I ran on a client's Lovable app after the April 2026 BOLA disclosure, plus the key rotation and Chrome extension SDK migration.

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook: cover image

·7 min read · supabase , supabase-realtime , security

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Realtime broadcast scope is a security boundary, not a routing convenience: cover image

·6 min read · security , supabase , auth-jwt

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

User enumeration via password reset: the bug in default forgot-password flows: cover image
Browse all 68 posts in the archive

All topics