The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Your Supabase app is working… but your database is still exposed? 🔐
One mistake I see developers make is setting up authentication and forgetting about Row Level Security (RLS).
If you're using Supabase, don't just create your tables and move on.
Make sure you:
✅ Enable RLS on your tables
✅ Create policies for who can read data
✅ Create policies for who can insert or update data
✅ Never expose sensitive service keys in the frontend
✅ Test your policies with different user accounts
Authentication tells you who the user is. RLS helps control what they can access.
Have you ever had an RLS policy block something that should have worked? 👇
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Trending
Claude
Claude has entered the design space. How are you using Claude Design?
Contra University
Learn from expert creatives how to earn more using next-gen AI tools.
creativeaiflow
Creative AI workflows are evolving. What tools do you use, and what are their strengths and weaknesses?
freelancerlife
Freelancer life is wins, pivots, and everything in between. What’s yours right now?
Related posts
A small update to my portfolio. Light mode ☀️ / Dark mode 🌙
One of those small details that makes browsing a little more enjoyable.
Check it out: https://badretdinov.com
Nice work
Hey Contra 👋
Two months ago I posted Promptly here as a work-in-progress and said I'd launch in about three weeks.
Then a health issue knocked me flat, and the three-week plan was gone.
I'm good now — and as of today, the build is done. I just published the full case study as well.
Quick recap: after shipping 20+ projects as a tech lead, I kept watching the same thing break. A founder says one thing, the developer hears another, and a month in, the whole build is based on a misunderstanding nobody caught early.
Promptly closes that gap. You describe your idea in plain English; the AI interviews you, pushes back on the vague parts, and writes a developer-ready spec while you chat.
But the chat is the easy part. The real engineering is everything that stops the AI from being trusted too much:
→ It never touches the database. 16 agents can only propose changes through typed tool calls; backend code checks each one, and invalid calls get rejected and logged.
→ Nothing ever gets lost. It snapshots before anything risky, so you can roll back a single module or the whole project.
→ Spend is capped, always. Every AI call passes four checks before it fires, and each one is logged with its exact cost.
One line sums up the architecture:
The AI proposes. The code decides.
The model gets to be creative. It never gets to be in charge.
Full case study is on my profile, and the product is live if you want to poke at it.
One question:
Shipped anything with LLMs in production? What guardrail saved you — or what missing one burned you?
Every comment on the last post shaped what got built. Thank you for that 🙏
building solo, in public
Congrats on shipping! Love the emphasis on hard guardrails and deterministic validation. That’s exactly how you build trust with LLMs. Excited to poke around the build.
Everyone's building AR filters and calling it "computer vision magic." Almost nobody's asking what's actually happening underneath — that most of these effects are just clever masking, not detection.
Here's proof. I built an invisibility cloak that runs entirely in the browser, no green screen, no chroma key, no model training.
https://github.com/AnuragNagare/Ghost-frame
Strong example of why the distinction between masking and detection matters. A useful next benchmark would be robustness under lighting changes and moving backgrounds, with latency and failure cases shown alongside the effect. That would make the trade-offs very clear for browser-based workflows.