ls ~/writing --tag=security

[01]Writing · Tag

Articles tagged "security".

$ tag --stat security
Articles
5
Published
Oct 2024→Apr 2026
Reading time
41 min
In series
1

Articles tagged security

5 articles

7 min [supabase][supabase-realtime][security]

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Supabase Production Hardening 6/8

supabase-realtime-broadcast-security-boundary--cover
Anyone who opens DevTools can subscribe to your Supabase channel and read every message.

6 min [security][supabase][auth-jwt]

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Supabase Production Hardening 5/8

user-enumeration-password-reset-leak--cover
Your forgot-password form will tell a stranger which of your customers have accounts.

7 min [security][supabase][edge-functions]

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Supabase Production Hardening 4/8

origin-validation-edge-functions-open-redirect--cover
Your own domain hands the user to the attacker’s copy of your login page.

10 min [authentication][security][2fa]

How to Implement TOTP(time-based one-time passwords) based 2FA in Bubble.io Without Using Any APIs?

Learn how to add Google Authenticator–style 2FA in Bubble.io using the Crazy Two Factor plugin - no APIs, no plugins, just secure TOTP authentication.

how-to-implement-totp-time-based-one-time-passwords-based-2fa-in-bubbleio-without-using-any-api--cover
Email codes get intercepted and SMS codes get SIM-swapped. A TOTP code never leaves the phone.

11 min [bubble][security][api]

Bubble.io API Security Best Practices

Secure Bubble API Connector calls by hiding endpoint URLs, marking private parameters, storing user tokens behind privacy rules, and cleaning test responses.

bubble-security-api-best-practices--cover
Your client secret sits in the browser console on every page load, for logged-out visitors too.

[02]Narrow it down

[03]Read in order

One series runs through this tag.

All articles