01Writing · Tag

Articles tagged "rls-policies".

At a glance
Articles
2
Published
Mar→Apr 2026
Reading time
14 min
In series
1

Articles tagged rls-policies

7 min supabasesupabase-realtimesecurity

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Supabase Production Hardening 6/8

Anyone who opens DevTools can subscribe to your Supabase channel and read every message.

7 min supabasesupabase-authpostgres

Two-layer identity models in Supabase: when auth and authorization disagree

Supabase Auth creates identities, not roles. Use a user_roles table, RLS policies, and one trigger migration so signups never strand users without permissions.

Supabase Production Hardening 1/8

The user did something weird.

02Narrow it down

03Read in order

One series runs through this tag.

All articles