ls ~/writing --tag=api-security

[01]Writing · Tag

Articles tagged "api-security".

$ tag --stat api-security
Articles
5
Published
Oct 2024→Jun 2026
Reading time
32 min
In series
1

Articles tagged api-security

5 articles

7 min [supabase][supabase-vault][postgres]

How to encrypt API keys and client secrets in Supabase

Store client secrets in Supabase Vault, keep searchable metadata in Postgres, and gate every decrypt behind one checked SECURITY DEFINER function. Step-by-step SQL with the gotchas.

Supabase Production Hardening 7/8

supabase-vault-encrypt-client-secrets--cover
A leaked backup or one overbroad rule, and your clients’ passwords are plain text.

6 min [security][supabase][auth-jwt]

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Supabase Production Hardening 5/8

user-enumeration-password-reset-leak--cover
Your forgot-password form will tell a stranger which of your customers have accounts.

7 min [security][supabase][edge-functions]

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Supabase Production Hardening 4/8

origin-validation-edge-functions-open-redirect--cover
Your own domain hands the user to the attacker’s copy of your login page.

7 min [supabase][supabase-auth][postgres]

Two-layer identity models in Supabase: when auth and authorization disagree

Supabase Auth creates identities, not roles. Use a user_roles table, RLS policies, and one trigger migration so signups never strand users without permissions.

Supabase Production Hardening 1/8

two-layer-identity-models-supabase--cover
The user did something weird.

5 min [apis][no-code][api-security]

Bubble.io Tips - 3

Learn essential Bubble.io privacy and security tips, optimize API calls, and implement best practices to protect your data and improve performance

bubbleio-tips-3--cover
Two empty fields match each other, the privacy rule passes, and the whole table opens.

[02]Narrow it down

[03]Read in order

One series runs through this tag.

All articles