Writing · Tag
Articles tagged "rls-policies".
2 articles on this topic.
Articles tagged "rls-policies"
·7 min read · supabase , supabase-realtime , security
Realtime broadcast scope is a security boundary, not a routing convenience
Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.
·7 min read · supabase , supabase-auth , postgres
Two-layer identity models in Supabase: when auth and authorization disagree
Supabase Auth creates identities, not roles. Use a user_roles table, RLS policies, and one trigger migration so signups never strand users without permissions.
