Two exploits, one public API key: the day I attacked my own Supabase app

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry.

Every app has its rockstar bug. Mine didn't crash, didn't throw, didn't page me at 3am. It just sat there in production — behind a paying customer's login — waiting for anyone with a browser to walk on stage and take a bow.

Then I decided to attack my own app with nothing but the API key I ship to every visitor. Two exploits took a bow that day. Here's how I caught them.

The setup: the key you hand to strangers

I run Zingui, a small family-finance app, on Next.js + Supabase. Real users, real paying subscriptions. Like every Supabase app, the browser ships with a public anon key — that's by design. Row Level Security (RLS) and function grants are supposed to be the wall that makes a public key safe.

Two exploits, one public API key: the day I attacked my own Supabase app

Related reading

The Door I Forgot to Lock, How One Missing Check Nearly Exposed Every Resume in…

My Summer of Sleuthing: 373 Merged PRs and the Bugs That Taught Me Everything

Smash Story: The Demo Script That Out-Debugged My Test Suite

Some Bugs Aren't in Your Code. They're Hidden in Your Dependencies.

I Built a Security App. Then I Tried to Break It Myself.

The bug that never crashed: how I fuzzed an AI's own code sandbox and found it…