6 ms·
> how are your security teams ok with exposing your PG server to the internet, relying mainly on RLS? And RLS isn't turned on by default, so full tables are exp
by xytofs 2y ago
> how are your security teams ok with exposing your PG server to the internet, relying mainly on RLS? And RLS isn't turned on by default, so full tables are exposed to the public internet by default, behind a rather nice REST API.
Tooling is improving constantly and security really is at the top of mind for us. We've got some cool announcements this week that will keep reminding you if you're doing something sketchy!
- omnibrain 2y agoAn access-simulator where you can check if a user (or anon) has some type of access would be helpful.
- kiwicopple 2y agowe actually have this: https://supabase.com/blog/studio-introducing-assistant#user-impersonation https://supabase.com/blog/studio-introducing-assistant#user-... and you can expect to see another related launch this week with some more in-depth tooling: https://github.com/supabase/splinter https://github.com/supabase/splinter
- atonse 2y agoGood to hear, thanks. I really am trying to provide constructive criticism (even if my tone is not great because the pain I'm continuing to feel with the platform is still fresh). I do think you guys are in a great position to actually improve all that tooling around RLS. Tools that can analyze your policies, that can visually map the recursive nature of policies that run, etc.