Jakob Hedrich

Update on my entry: before publishing, Lovable's security scan warned that my app's database rules let anyone read the customer tables. I checked it myself, and it was true: with the app's public key, all 5 tables returned data. It's the same kind of problem as...

I built a free checker for GitHub's Nov 2 change: from that day, pull_request_target workflows stop running on public repositories unless an Actions policy allows them. Paste a repository and you get, in seconds, which workflows are affected and what to do:...