alt Hacker NewsThe part people are ignoring is Supabase's culpability in this matter: https://github.com/orgs/supabase/discussions/4547
This was supposedly fixed on October 30, but there are reports floating around that for existing projects, the defaults still apply.
Lovable deserves some heat for using this, but this was a choice that was made by Supabase many years ago to support making it easier to onboard potential customers, a deliberate tradeoff of less onboarding pain for less security.
While we’re at it, I was quite surprised to discover that Supabase leaks schema information through the `hint` field in error messages:
https://docs.postgrest.org/en/latest/references/errors.html
For example, if you try to access a table named "secret" that doesn’t exist, Supabase might return a hint saying, "Perhaps you meant the table 'public.super_secret'."
Thanks for volunteering that information, I guess.