Field notes
Short notes on real bugs from client projects: what broke, the number that showed it, the fix, and how to check your own app.
- SupabaseSupabase 42501 permission denied: a grant, not RLS
Why Supabase returns 42501 permission denied for a table, what changes on 30 October 2026, and the grant, RLS and policy that fix it, reproduced locally.
- SupabaseSupabase exposed schemas: what the list opens up
What the Exposed schemas setting in Supabase means, how my security checker grades extra schemas, and one SQL query that finds tables without RLS in them.
- PostgresA NULL in a PL/pgSQL IF NOT skipped the check on 3683 tasks
In a SECURITY DEFINER function, false OR NULL is NULL and IF NOT skips the RAISE. Why the same check is safe in RLS, the coalesce fix, and how to sweep for it.
- SupabaseSupabase raw_user_meta_data: how a sign-up became Owner
A handle_new_user trigger took role_id from raw_user_meta_data, which the browser sets at sign-up. How anyone became Owner, the invite fix, a 1-minute check.
- SupabaseSupabase multi-tenant RLS: why a user in two orgs leaks data
An RLS policy that checks org membership is true in both orgs for a user who belongs to two. What my probe found, the fix, and a two-minute check.