01Writing · Tag

Articles tagged "security".

At a glance
Articles
5
Published
Oct 2024→Apr 2026
Reading time
41 min
In series
1

Articles tagged security

5 articles

7 min supabasesupabase-realtimesecurity

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Supabase Production Hardening 6/8

Anyone who opens DevTools can subscribe to your Supabase channel and read every message.

6 min securitysupabaseauth-jwt

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Supabase Production Hardening 5/8

Your forgot-password form will tell a stranger which of your customers have accounts.

7 min securitysupabaseedge-functions

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Supabase Production Hardening 4/8

Your own domain hands the user to the attacker’s copy of your login page.

10 min authenticationsecurity2fa

How to Implement TOTP(time-based one-time passwords) based 2FA in Bubble.io Without Using Any APIs?

Learn how to add Google Authenticator–style 2FA in Bubble.io using the Crazy Two Factor plugin - no APIs, no plugins, just secure TOTP authentication.

Email codes get intercepted and SMS codes get SIM-swapped. A TOTP code never leaves the phone.

11 min bubblesecurityapi

Bubble.io API Security Best Practices

Secure Bubble API Connector calls by hiding endpoint URLs, marking private parameters, storing user tokens behind privacy rules, and cleaning test responses.

Your client secret sits in the browser console on every page load, for logged-out visitors too.

02Narrow it down

03Read in order

One series runs through this tag.

All articles