01Writing · Tag

Articles tagged "api-security".

At a glance
Articles
5
Published
Oct 2024→Jun 2026
Reading time
32 min
In series
1

Articles tagged api-security

5 articles

7 min supabasesupabase-vaultpostgres

How to encrypt API keys and client secrets in Supabase

Store client secrets in Supabase Vault, keep searchable metadata in Postgres, and gate every decrypt behind one checked SECURITY DEFINER function. Step-by-step SQL with the gotchas.

Supabase Production Hardening 7/8

A leaked backup or one overbroad rule, and your clients’ passwords are plain text.

6 min securitysupabaseauth-jwt

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Supabase Production Hardening 5/8

Your forgot-password form will tell a stranger which of your customers have accounts.

7 min securitysupabaseedge-functions

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Supabase Production Hardening 4/8

Your own domain hands the user to the attacker’s copy of your login page.

7 min supabasesupabase-authpostgres

Two-layer identity models in Supabase: when auth and authorization disagree

Supabase Auth creates identities, not roles. Use a user_roles table, RLS policies, and one trigger migration so signups never strand users without permissions.

Supabase Production Hardening 1/8

The user did something weird.

5 min apisno-codeapi-security

Bubble.io Tips - 3

Learn essential Bubble.io privacy and security tips, optimize API calls, and implement best practices to protect your data and improve performance

Two empty fields match each other, the privacy rule passes, and the whole table opens.

02Narrow it down

03Read in order

One series runs through this tag.

All articles