creatornader

It's a shame that making things easy to use has typically meant the user gives up control/hosting capabilities and generally gets less security out of the box. You're probably right about Supabase, that they made that tradeoff explicitly, but they have more demand than they keep up with and finally seem to be course correcting toward more secure defaults that apparently will make onboarding their users more difficult (this is a false dilemma IMO). There isn't a real attempt at transparency with the app builders e.g lovable, bolt, v0, replit, base44 because that's not really the point. The vibecoding tools all sell the idea of a concierge service but that only works if the experience is actually "luxury" which in this case means you can trust in a guaranteed basic level of data privacy. People who don't get Postgres and RLS implement it sloppily and you inevitably get cases like this. You can put that on the user but I think platforms have a higher bar here to create experiences or interfaces where the easy path is the most secure one. There are obviously many other parts of these process that can be leaky beyond the database as well so the app architecture needs to make the system cohere together securely and I just don't feel like the existing options are fully up to the task.

This idea of what constitutes a “black box” and at what level of abstraction is very interesting. Take open weights for example - the weights being open affects where you can run inference (you can self-host) and allows you to modify the parameters via fine-tuning, BUT it doesn’t necessarily affect your ability to understand what a model is doing and why. Even when we’re deploying open models on our own infra, our understanding and control over model behavior is still pretty rudimentary.