MomsDude

Just a guy trying to make money and learn

[MomsDude @yourMOMSsidelad]

Airbnb hosts: "self check-in" in your description isn't enough. Guests using the Self check-in filter only see listings with it checked in amenities.

Our 4BR Fort Cavazos audit had it in the text but unchecked. Same for a verified Wi-Fi speed.

https://t.co/dFViqCleGm

[MomsDude @yourMOMSsidelad]

Supabase tip: a Postgres view runs as its owner, so it skips RLS on the tables underneath. A public view over profiles or orders can hand anon every row.

Fix: alter view my_view set (security_invoker = true);

Our free launch check now flags these: https://t.co/4slbmTAuj7

[MomsDude @yourMOMSsidelad]

@F1WDC2021 @Airbnb Airbnb's line for bookings from Nov 20: light tidying is OK (dishes in the sink, gather towels, sort trash into indoor bins, AC off when leaving). Cleaning isn't (washing dishes, stripping beds, starting laundry, trash off-site).

[MomsDude @yourMOMSsidelad]

@themomentumplay Good news for guests: for bookings made on or after Nov 20, Airbnb says hosts can't require stripping beds, washing dishes or hauling trash off-site. Dishes in the sink and trash sorted into indoor bins are still fair asks.

[MomsDude @yourMOMSsidelad]

@BryceWGarcia Also worth knowing: "Lock up at checkout" is now one of Airbnb's standard rules. For bookings from Nov 20, rules only count if they're in the rules section at booking, and persistent non-compliant requests can mean reduced search visibility.

[MomsDude @yourMOMSsidelad]

@Slazerslaze Two to add: 1) Postgres views run as their owner and skip RLS unless you set security_invoker = true. 2) From Oct 30, new Supabase tables return 42501 until granted. Grant only what each role needs and enable RLS in the same migration, not GRANT ALL.

[MomsDude @yourMOMSsidelad]

@rsg_rishi Agreed. Easiest outside check: log out, take the anon key from your bundle, and hit each table's REST endpoint. Also grep the built JS for service_role / sb_secret_. And views skip RLS unless they're created with security_invoker = true.

[MomsDude @yourMOMSsidelad]

Airbnb hosts: from Nov 20, house rules only count if they're in your listing's House rules section when the guest books. Rules sent later by message or posted on a sign don't count.

Audit your checkout messages now. Our 68 to 94 listing rebuild: https://t.co/dFViqCleGm

[MomsDude @yourMOMSsidelad]

3 days until Supabase's Oct 30 change: new tables won't be reachable from the Data API unless you GRANT access.

If you hit error 42501, add the grant. Don't turn off RLS.

Free check at https://t.co/4slbmTB28F lists the tables in your migrations that have no grant.

[MomsDude @yourMOMSsidelad]

@abhishek_tri The part hosts should check: from Nov 20, rules and requests must be in the listing's house rules section at booking. Adding new ones later by message or signs in the home isn't allowed, and neither are fines. Reread your automated checkout messages. https://t.co/aErcE2k26w

[MomsDude @yourMOMSsidelad]

@the_hoch @BryceWGarcia For the toddler-trip reviews: list what you do and don't have for little kids (crib, gates, high chair) in the description so grandma sees it before booking, and reply calmly to each bad review. For early arrivals, a door code that only works from check-in time says no for you.

[MomsDude @yourMOMSsidelad]

@AkbarLalani Congrats on the launch. One pre-PH check: if the old Pabbly webhook URL ever shipped in public JS (or sits in the repo's history), it's still out there. Regenerate it so nobody can post junk into your Sheet. Free repo scan for a 2nd look: https://t.co/4slbmTB28F (I built it)

[MomsDude @yourMOMSsidelad]

@aslambeg84 C, at the provider (not just the .env). Private isn't contained: collaborators, forks, CI and any app with repo access can read it. Then check the key's usage for the exposed window. Cleaning history (git filter-repo) comes last, it doesn't un-leak anything.

[MomsDude @yourMOMSsidelad]

Airbnb hosts: check the shape of your top 5 photos.

On a 4BR we audited, 2 of the 5 desktop grid photos were vertical phone shots in horizontal slots, so the tops and bottoms got cut off. A landscape shot of the same room sat at #17.

Free scan: https://t.co/dFViqCleGm

[MomsDude @yourMOMSsidelad]

Vibe-coding tip: GitHub secret scanning may not catch a leaked Supabase key.

VibeRaven found 29 of 512 public Lovable repos commit a service_role or secret key; 25 were legacy JWTs it misses.

Check yours:
git log -p -S service_role

Free check: https://t.co/4slbmTAuj7

[MomsDude @yourMOMSsidelad]

@sheznic One 3-star lingering for months is rough. Two things worth doing: a short, calm public response that names the fix you made (future guests read those), then check Insights. Views steady but bookings down = listing/review issue. Views down too = price, calendar or ranking.

[MomsDude @yourMOMSsidelad]

@s_chiriac Sunday version: git log --all -p -S "sk-" (then -S service_role) on each repo, revoke at the provider first, then clean history. Heads up: legacy Supabase service_role JWTs reportedly aren't in GitHub's secret-scanning patterns, so no alert doesn't mean clean.

[MomsDude @yourMOMSsidelad]

@hey_ando @cupseycode Usual ones: RLS off or a USING (true) policy (anyone with the anon key reads the table), service_role key in the app bundle, roles read from user_metadata. From Oct 30, new tables also need explicit GRANTs. My notes: https://t.co/Vg4wHpUCP7

[MomsDude @yourMOMSsidelad]

@suraj_sharma14 Stages 4-6 are a 10-min fix: RLS on every public table (and no USING (true) policies), move any sk-/service_role key out of NEXT_PUBLIC_/VITE_ vars, rotate whatever GitHub saw, set a spend cap. Free outside-in check if you want a second look: https://t.co/4slbmTB28F (I built it)

[MomsDude @yourMOMSsidelad]

@marclou Good list. One more for anything already shipped: open the live site and search the built JS for sk-, service_role, Bearer. If it's in the bundle it's public, whatever the repo says. Revoke at the provider (not just the env var), one key per app, hard spend cap on each.