niklasd
Joined 8 years ago
Joined 8 years ago
We have a dashboard that displays aggregated stats for our admin users, and we hit serious performance issues with ~600 users with our first implementation. This repo helped us: https://github.com/GaryAustin1/RLS-Performance
Additionally, I find it hard to keep a good overview over the rules. E.g., in a multi-tenant application one needs to secure every table with a restrictive rule, and it's easy to make a rule permissive, since that is the default & it's not indicated in the Studio UI.
When generating migrations with 'supabase db diff' views are being recreated without 'WITH (security_invoker)' even though they had security_invoker turned on before, leaving your database exposed. Easy to miss, even when you're aware of that.
RLS is just so full of footguns that I find it hard to justify using it in a production system.
(But otherwise I love Supabase! Great job.)
I mean their cash pile is also invested in money markets (so you get that), and the rest of the portfolio consists of quality companies where their (combined) valuation didn't explode in the last 1,5 years. So it's an opportunity to invest into something that might not be overheated.