Recently I started noticing the same problem with a lot of my friends who are building apps with tools like Lovable and Supabase. They build something quickly, get users but get stuck when trying to manage the security of their Supabase projects because it's too complicated and expensive.
After talking with a lot of my vibe coder friends I kept noticing the same problem, one friend wasn't sure whether his RLS policies were actually working correctly. Another didn't really know which Supabase tables were accessible publicly. And in a few cases, people had built pretty substantial apps without really knowing what someone outside the app could access.
I come from a security background, so I started helping some friends check their projects manually. After doing this a few times, I started wondering whether this could just be automated.
That's what eventually led me to start working on DefenceCore.
The idea is pretty simple: continuously check a Supabase project for security problems and explain them in normal language, including what needs to be fixed.
I would love to hear your thoughts and tips for improvement :).
For people here building with Supabase:
What part of securing your project has been the most confusing?
1 comment
[ 0.21 ms ] story [ 11.9 ms ] threadRecently I started noticing the same problem with a lot of my friends who are building apps with tools like Lovable and Supabase. They build something quickly, get users but get stuck when trying to manage the security of their Supabase projects because it's too complicated and expensive.
After talking with a lot of my vibe coder friends I kept noticing the same problem, one friend wasn't sure whether his RLS policies were actually working correctly. Another didn't really know which Supabase tables were accessible publicly. And in a few cases, people had built pretty substantial apps without really knowing what someone outside the app could access.
I come from a security background, so I started helping some friends check their projects manually. After doing this a few times, I started wondering whether this could just be automated. That's what eventually led me to start working on DefenceCore.
The idea is pretty simple: continuously check a Supabase project for security problems and explain them in normal language, including what needs to be fixed.
I would love to hear your thoughts and tips for improvement :).
For people here building with Supabase: What part of securing your project has been the most confusing?