xyborg
Joined 15 years ago
Karma
36
Submissions
22
Member since
Jan 9
LinkedIn: https://www.linkedin.com/in/aberastegue/
Twitter/X: @xyborg
View on Hacker NewsRecent submissions
Comment · 9 months ago
I have been playing around iOS apps now, I found many with exposed Firebase instances as well :/
Comment · 9 months ago
Thanks, Paul, for the comment. It means a lot to me.
I also published a recap of what Supabase has been doing over the last year to improve all of this: https://supaexplorer.com/dev-notes/supabase-security-2025-wh... I now think it makes sense to include it in the top notice I added to my report, next to where it says "Supabase is NOT insecure by design," since key revocation was one of those changes.
I believe we all know, at least the ones who care about this topic, that you've been making a lot of improvements and adding extra annoying (but justified!) UI features to make this issue more prominent and push people to fix it.
"- contractually requiring Vibe coding platforms to expose our Security Advisors if they are integrating with us" - I like this, and I honestly would love to see those platforms truly enforce it, even when the user is just building an MVP not ready for production, which most of the time ends up there.
And definitely, any improvement in authz will be very helpful, especially if it can be pushed via external coding platforms.
Comment · 9 months ago
Yes, sometimes is hard, and also kinda frustrating when they don't seem to care about their users' data privacy.
For Android/iOS, I know those are even worse, but it's tricky to get the data, might be easier to get and decompile the APKs though.
Comment · 9 months ago
The vast majority of the web apps in those launch directories were built using some sort of AI tool, also there are certain fingerprints you can use to confirm some tools, like Lovable, V0, etc.
Comment · 9 months ago
Yes, both statements are true, I am building a business around this, but I do also want to reduce the amount of insecure Supabase applications, and that's why I open sourced, and it's also free, my Chrome Extension. Because that's a quick check, any non-technical person can do.
I am currently in communication with many of the sources I used to harvest those sites, so they can warn them, and I also offered a quick API integration that can plugged in during their submission process, so they can warn users right before they launch their apps on those directories. Another option is to get their contact information, but there is no way I can get into their inboxes without being labeled as SPAM :/
Also, another thing I offer for free on my site, is the possibility of running an automated audit on your project, you just connect to Supabase using oAuth. And get a report of what's missing, from there you can either click the "fix in Cursor" or copy results button, and ask your favourite LLM to fix it, or buy my advanced report with the fixes for 5 bucks. But I do offer a free options though.
About this: "- LLM generated code: benchmark and evals to measure which popular programmatic LLMs recommend the right approach.", check this out https://cset.georgetown.edu/wp-content/uploads/CSET-Cybersec...
And, when it comes to community recommendations, I am doing my best, reaching out to dev influencers, posting regularly on /r/Supabase/ (not spamming, providing real value).
Last but not least, Supabase did added a LOT of new features in their dashboard to warn and prevent users from shipping tools unprotected, but the issue is many of these apps were created using CLI, GUI, or Web tools where the user almost never go to Supabase's dashboard, so they never see those warnings :(
Comment · 9 months ago
Something remarkable happened in 2024-2025: building a full-stack app became easy. Tools like Supabase, combined with AI coding assistants and no-code builders, let solo founders ship production apps in days, not months.
But speed comes at a cost. As we started using SupaExplorer to audit projects, we noticed a pattern: many apps were misconfiguring their Supabase setup. The anon key in client-side code is fine; it's designed to be public. But we found apps exposing the service_role key (which bypasses RLS), or using the anon key with tables that had no RLS policies at all.
We decided to quantify the problem. Over the past month, we collected launch URLs from five major indie product directories and systematically scanned each one.
- 20,052 URLs Scanned - 2,217 Domains Exposed - 11.04% Exposure Rate - 2,325 Critical Exposures
What's Being Leaked
Not all exposures are equal. Finding a Supabase project URL and anon key in client code is expected, as both are designed to be public. The anon key provides low-privilege access that respects your Row Level Security policies.
The danger is when apps expose the service_role key (or the new sb_secret_... format), the elevated-privilege key meant only for server-side use. Of the 2,960 files flagged, we found credentials that could bypass RLS in a significant portion. We also verified which exposed databases had tables without RLS protection.
I would love to hear your thoughts on this, and how can we generating awareness about this topic.
Comment · 2 years ago
The FAQ section is fixed now.
Comment · 2 years ago
I focused on puppies, but elderly dogs is a nice use case though. Thanks for the input!
Comment · 2 years ago
This is a nice use case though, helping with communication.
Comment · 2 years ago
I probably wont continue doing it for long as well. I thought about this out of the necessity of tracking my puppy potty training. And it's not that we forget about going for a walk, is more like getting an idea of at what time of the day, on which frequency they need to pee or poop, and arrange the walks around those times so they can learn to do it outside quickly.
So, this might be useful for puppy and also elder dog owners.
Comment · 2 years ago
Thanks! I will check that out. It's possible to share your dog with other people, when you add a dog, the app generates a unique ID with a three-word-format you can share with other people so they can add the dog to their profile. I thought about this for sharing internally in the family, or for when you want your pet sitter to keep tracking your dog activities. And as the owner, you can revoke their access anytime.
The PDF/report is a great idea. I will give it a look on how other apps handle this to get some inspiration :D
Comment · 2 years ago
I need to find some time to put some screenshots together, and record a quick video explaining how it works, and maybe split it so I can use it in the guide.
Noted! Google sign in is on my pending list now, it would also be very helpful for reducing fake/spam accounts for sure.
Ah, thanks for highlighting this! I must have messed up during the design fix I did last week :S