gku
Joined 4 years ago
Karma
53
Submissions
31
Member since
Jan 14
Joined 4 years ago
> We conducted a non-intrusive security review, simply by browsing like normal users. Within minutes, we discovered a Supabase API key exposed in client-side JavaScript, granting unauthenticated access to the entire production database - including read and write operations on all tables.