The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Row-level security scopes rows. It says nothing about columns.
I found this in my own live product, whiI had RLS policies on every tenant table. I had reviewed them. They were correct: a user may update the row whose id matches their own, nothing eThen I tried it from the browser console. Update my own row, set plan tIt worked.
Not a bug in the policy. The policy did exactly what it said. The row genuinely belonged to me, the check genuinely passed, and I got a free upgrade. The same class of write let me grant myselfThe mistake was assuming RLS could express something it has no vocabularThe fix was three layers.
RLS with FORCE enabled, because Postgres exempts a table's owner from its own policies unless you force it. ThaA before-update trigger that compares old to new and rejects writes to plan, role and tenant columns unless the caller is an authorized internMetering moved into security-definer functions, so the client supplies no count and cannot reach the counter.
Then fifteen integration tests. Each one performs the attack and asserts the database refuses it. Most auth suites cIf you run multi-tenant Postgres, the question worth asking tonight is not whether your policies are correct. It is whether the thing you are relying on caFull write-up and the repo are on my profile.Anyone else hit this one?
n express the rule you think you wrote.
onfirm that permitted actions succeed, which is the less useful half, because a policy that is too permissive passes every happy path test you can write.
al writer.
t one is silent. No error, no warning, and your system looks fine while it is wide open.
y for. It answers which rows. It says nothing about which columns of those rows.
admin, reset my usage counter, and move myself into a different tenant.
o pro.
lse.
ch is the part that stings.
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Trending
retrofuturism
Share your favorite designs from the past exploring the distant future. Or your own take on the aesthetic 🚀
halftone
Dots. Texture. Grain. Let's see your designs using the halftone technique.
Midjourney
Creatives are showing off what they're making with Midjourney.
colorgrade
Video editors sound off: How do you enhance the mood of your video in color grading?
Related posts
How do you handle your component architecture?
Here was my approach on a five-step insurance purchase form.
The form has two paths through it. A person fills in different things than a company does. Someone already logged in skips a step. One path gets a document upload that the other never sees.
The easy version is to build the fields for each step as you get to them. I have done that before. By the second change request you have five sets of nearly identical fields and no way to change one without checking the other four.
So I wrote one input instead. You tell it what kind of thing it is and it does the rest. Three kinds covered the whole form: a fixed list of options, a list that comes from the backend like car makes, and pairs of a value and a label.
Every step is then just a list of which fields it needs. And the decision about who sees what does not sit in the inputs at all. It sits above them, in one place. An input never knows which path the user is on.
The part that told me it was right: the whole thing can be lifted into the insurance back office later without rewriting it, because nothing inside it knows what site it is on.
This has a really strong finish 🔥
Title: Allubmarket Multi-Panel Business Platform & Mobile Apps
Preview: Built a Laravel/Firebase business directory platform from the ground up web, mobile, and everything in between.
Description:
Built Allubmarket from scratch a multi-panel business directory and marketplace platform (Admin, Web, Business panels) on Laravel with Firebase/Firestore as the data layer, including original Firestore data architecture, Cloud Functions deployment, and admin panel setup, plus two companion Flutter apps for consumers and business owners.
What I did:
Architected and built the platform from the ground up Firestore schema, Cloud Functions, role-based session handling across panels
Diagnosed and fixed production critical bugs in auth, signup, and data flows across web and mobile
Cut homepage load weight by several MB removed unused scripts, compressed and properly sized images, fixed layout-shift issues
Built SEO infrastructure from scratch (URL slugs, sitemaps) across multiple subdomains
Led a full brand migration across web, mobile, and translation layers
Built and shipped two production Flutter apps fixed crashes, improved performance, set up iOS CI/CD
Stack: Laravel · Firebase/Firestore · Flutter · MySQL · Hostinger
Badge
Your entire sales toolkit in one shareable profile. Badge creates AI-powered digital profiles that capture leads instantly and track engagement in real-time. Turn every interaction into a sales opportunity with customizable profiles (e.g. withbadge.ai/yourname), QR codes for connecting, lead notifications, and real-time analytics on profile views and prospect activity.
