The Canary Check

One finding, one fix, before you ship. A 3-minute weekday security note for people building with Lovable, Bolt, Cursor, Supabase and Firebase. Subscribe free.

• #004: Your AI agent's Supabase token is too powerful
  2026-10-15 · Scoped tokens are live. Swap the all-access one today.
• #003: "allow read, write: if true" is still live
  Test mode rules don't belong in a launched app.
• #002: That SECURITY DEFINER function is a public API
  Default grants make it callable with your public key.
• #001: Supabase stops auto-exposing new tables on Oct 30
  Don't fix the 42501 error with a blanket grant.