Rishabh

Most AI demos die in production.
I ship the systems that don't, and write about what almost killed them.

[Rishabh @rispectrum]

The anon key in your app's JavaScript is supposed to be public. That part is fine.

What isn't: Row Level Security is the only thing standing between that key and every row you own, and the app your AI builder generated never wrote the policies.

Check it in 5 seconds:

SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname='public';

All 'f'? Anyone holding your key can read those tables. Including the ones you forgot about.

Numbers, so this isn't just vibes. CVE-2025-48757 found 170 of 1,645 sampled Lovable projects like this (~10%). A separate scan of 5,600 AI-generated apps: 58% shipped at least one critical vuln, 400+ had secrets sitting in the frontend bundle.

Then in April, Lovable itself exposed other people's source code and service keys for ~2.5 months. No amount of RLS on your side would have helped with that one.

I keep a checklist of what I keep finding. Free, no signup, sources in the reply.

[Rishabh @rispectrum]

@theo @VictorTaelin Why is opus below muse spark and grok? If this is true I’d need to reconsider my workflows 🙄

[Rishabh @rispectrum]

@CommandCodeAI Definitely a Chinese model

[Rishabh @rispectrum]

@EvanOtero a better model. Wdys?

[Rishabh @rispectrum]

@marfinxx 1.4M tokens of tool residue is such a clean number, the agent is basically drowning in its own notes

[Rishabh @rispectrum]

@CoreyGallon @KentonVarda @aiDotEngineer the sandboxing is the part I actually wanted, otherwise it's just vibe coding on someone else's tenant

[Rishabh @rispectrum]

@1clawAI @AnthropicAI @cursor_ai admin creds and no spend cap is how these become other people's problem overnight

[Rishabh @rispectrum]

@DanielGlejzner the hell no is the honest bit. did two users actually get isolated on the same table or is RLS just on the feature list

[Rishabh @rispectrum]

@DanKornas yeah fail-closed on USING (true) is the right bar. is that already in the skill or still a todo

[Rishabh @rispectrum]

@blankspeaker nice that the hook now reports the Turn — still a bit worried the writer can pass a hook it just wrote

[Rishabh @rispectrum]

@BedrockDataAI @TechTargetNews can't govern what you can't see is the MCP problem too, because tool output and project memory are a second datastore and they hold keys the postgres policies never see.

[Rishabh @rispectrum]

@shehackspurple vibe coding as the vuln is right, and the concrete version is generated supabase apps that ship the anon key on purpose and skip the policies, so auth is a UI and the table is the product.

[Rishabh @rispectrum]

@NickGStacked a scanner helps, but the miss I keep seeing isn't XSS, it's RLS off or `USING (true)` on the table the login supposedly protects. if two test users and one curl with the anon key lets B see A's rows, the scan didn't finish.

[Rishabh @rispectrum]

@josesilesdata spec-kit without a security constitution still ships the default of RLS off, `USING (true)`, and a service role in the client, so the spec should fail the build if `relrowsecurity` is false.

[Rishabh @rispectrum]

@e0b3_sec the login form is decoration if RLS is off, and the next check is policies that say `USING (true)`, which look enabled and are still a buffet. two accounts on the same table is the test.

[Rishabh @rispectrum]

@HAGOCommunity the running-online step is where these die, because the supabase anon key is public on purpose, so if RLS is off or the policy is `USING (true)` the login screen is just a sticker. two users on one table is the exam.

[Rishabh @rispectrum]

@tej____18 the leftover that actually bites is project memory and tool output that still has the anon key or a session cookie, because `.claude/` and agent transcripts are a second database and they don't get RLS.

[Rishabh @rispectrum]

@thisistonydang @panda_liyin yeah that's the right split. if it's your team's skill, auto-update is just deploy. i only get weird about the public ones you installed once and forgot. those github accounts change hands. toggle is good. i'd still keep it off unless i picked the commit.

[Rishabh @rispectrum]

@NickGStacked The ‘em dash is on purpose 🙏

[Rishabh @rispectrum]

@panda_liyin @thisistonydang MCP auto-update is a patch. skill auto-update is a silent instruction change with a diff you never see. pin the hash. treat `skills/` like `package-lock`.