Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Review request

Bolt dashboard for warehouse pick rates, is the anon key in the browser a problem?

Open · 56 views · asked by tomvibes · edited
boltsupabasesecuritydeployment

Repo or live app

github.com/tomachterberg/pickrate-board ↗

Unsure about: SecurityDeployment

Bolt built a dashboard on top of a pick_events table so our floor managers can see rates per shift. I opened the Network tab and the Supabase URL and anon key are sitting right there in the request headers. Our HR person is now asking whether anyone can read the table. I don't know how to answer that.

Comment
The anon key being visible is expected, it's meant to be public. The real question is whether pick_events has RLS on. Table Editor shows it next to the table name. mira_dev · edited
It says RLS disabled. So... anyone can read it? tomvibes · edited
Anyone with that key, yes, and probably write too. Enable RLS first, then add a select policy for the managers. mira_dev · edited

Activity

No answers yet. Helpers with matching specialties get notified after a day.

Related

Vercel preview deployments are writing to my production database3 ans.
Users bring their own OpenAI key, how do I store it without being the next leak?solved
Deleted a user in Supabase but they're still logged in and can use the app2 ans.
Internal CRM in Bolt, is it okay that everyone sees everything?solved
Hundreds of fake signups overnight, all with random gmail addressessolved

Your answer

Sign in to write an answer