News for hackers. Stuff that matters.

A comment on Lovable apps expose passport details and more than 200K private messages. Parent comment

Re:Lovable apps expose passport details and more than 200K p... by dabbz on Sunday November 15, 2026 @01:05AM (#50504412)
I think the idea is to use edge functions against the database with RLS helping with low level access control, but it's still a tough design pattern to hold people accountable to. May as well as write the whole thing in a backend and just skip Supabase's API/RLS entirely.
[ Parent | on HN ]
Re:Lovable apps expose passport details and more than 200K p... by reassess_blind on Sunday November 15, 2026 @01:17AM (#50504465)
The whole proposed benefit of their "query the database from the client" concept was the speed and ease of development. If you need edge functions (cost per invocation too, mind you) to make this happen, it's just a terrible design in general.

I agree. If AI agents are doing all the code anyway, as is the case with Lovable, just turn off the Data API entirely and access the DB from the backend only like a typical Postgres setup.

[ Parent | on HN ]