The latest articles on DEV Community by Demo Account4 (@demo_account4_b3e97967364). https://dev.to/demo_account4_b3e97967364 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4241354%2Fb6e0b0e6-a2e2-45b7-b6a9-9962a16fc6ed.png https://dev.to/demo_account4_b3e97967364 en Demo Account4 Thu, 12 Nov 2026 15:16:09 +0000 https://dev.to/demo_account4_b3e97967364/validating-before-building-a-security-audit-cli-for-ai-built-supabase-apps-4bdo https://dev.to/demo_account4_b3e97967364/validating-before-building-a-security-audit-cli-for-ai-built-supabase-apps-4bdo <p>AI tools produce working Supabase + Next.js apps quickly, and a lot of them go live with the database readable by anyone. CVE-2025-48757 covered 170+ apps with exactly this problem: Row Level Security missing or misconfigured.</p> <h2> The idea </h2> <p>One command that audits a project and prints what to fix:</p> <ul> <li>tables with RLS disabled</li> <li>policies that let everyone in, like <code>USING (true)</code> </li> <li>the <code>service_role</code> key in client code or public env vars</li> <li>API routes that read the database with no auth check</li> <li>webhooks with no signature verification</li> <li>public storage buckets</li> </ul> <p>It would also ship skills that let Claude Code or Cursor apply the fixes. The core would be free and open source, with a paid version at $29–$49 one-time.</p> <h2> Where it stands </h2> <p>I have not written it yet. I'm testing demand first. My bar is 20 waitlist signups in 7 days; if it misses, I move on to the next idea.</p> <h2> What I'd like to know </h2> <ol> <li>What do you check by hand before launching a Supabase app today?</li> <li>Which of these checks would you not trust a tool to get right?</li> <li>Would you pay for this, or is a free checklist enough?</li> </ol> <p>There is nothing to buy. If you want one email when it launches, the waitlist is here: <a href="https://shipaudit-ebon.vercel.app" rel="noopener noreferrer">https://shipaudit-ebon.vercel.app</a></p> supabase nextjs security webdev