Just started vibing and have integrated codex into my side project which uses Supabase. I turned off RLS so that could iterate quickly and not have to mess with security policies. Fully understand that this isn't production grade and have every intention of locking it down when I feel the time is right. I access it from a ReactNative app - no server in the middle. Codex does not have access to my Supabase instance.

RLS doesn’t slow you down. It actually speeds things up because you are forced to design things properly. It’s like type checking.

That makes sense and appreciate the response. Definitely a topic I need to invest more time with if that is the case.

There is a server in the middle. It's the machine running Supabase.

Of course. What I meant was I'm calling Supabase directly from the client instead of handing off the request to for example Node / Express and having that manage the req / res.

My thought exactly. Is this standard practice with using Supabase to simply expose the production database endpoint to the world with only RLS to protect you?

Supabase is aware of this and they actually put big banners stating this flaw when you unlock your authentication.

What I think it happens is that non-technical people vibe-coding apps either don't take those messages seriously or they don't understand what it means but made their app work.

I used to be careful, but now I am paranoid on signing up to apps that are new. I guess it's gonna be like this for a while. Info-sec AIs sound way worse than this, tbh.

There was a post not long ago about a HN user who wanted to both advocate and help people out of this danger:

https://news.ycombinator.com/item?id=46662304