Who made you admin? Ember checks your Supabase role column

Ember promoted herself to Head of Security. Your users shouldn't be able to.

Here's the catch: Supabase RLS policies decide which rows a user can update, not which columns. If role or is_admin lives on your profiles table and users can update their own row, they can set it from the browser with the public key.

The two-minute check

1. Does your profiles table have a role or admin column?
2. If so, allow updates only on safe columns, or move roles somewhere users can't write. Our guide shows the SQL.
3. Then scan your own app on SniffPup for other open doors.

Promotions are earned with treats.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.