Ballaz

My app got hacked last night and 35,000 profiles were wiped. Here’s what happened / how to prevent it: I bypassed RLS with a view so users could see each other's profiles, and didn't revoke Supabase's default anon permissions, so the public key could delete everyone through it (a truly awful rookie mistake from me). Here’s a prompt so this NEVER happens to you: Audit my Supabase project for security holes. Assume the anon key is public and anyone can call my REST API with it, logged out or with a free account. Check and fix: 1. Every table in public has RLS enabled, and every policy scopes rows to auth.uid(). Flag any policy that is just "true", especially on INSERT, UPDATE or DELETE. 2. Every view: is it security_invoker = true? Can anon or authenticated INSERT, UPDATE or DELETE through it? Revoke write grants on all views. 3. Revoke delete and truncate on all tables from anon, and set alter default privileges so new tables don't get them. 4. List every ON DELETE CASCADE from user tables and confirm that nothing a client can delete cascades into data it shouldn't. 5. Every security definer function: who can execute it, and does it trust a user id passed as a parameter instead of auth.uid()? 6. Every profile column that grants access (pro flags, trial dates, roles, admin) can only be changed by the server. Add a trigger that ignores client writes to those columns. 7. Every API route: it reads the user from the verified JWT, never from the request body, and checks ownership before reading or writing. 8. Crons and webhooks fail closed when their secret is missing, and webhooks verify signatures. 9. No temporary auth bypasses, hardcoded keys or guessable passwords. 10. Add a safety net: limit deletes per request on key tables, keep an audit copy of deleted rows, alert when row counts drop, and confirm backups work. For each finding, show the exact SQL or code fix and explain what an attacker could do today. Then run Supabase Security Advisor and fix everything it reports.

I'm selling my body. On September 19th, I'm competing in my first HYROX race in Turkey. You can advertise your startup on 10 of my muscles: - Your website is listed on hyrox.marclou.com - Your logo will be tattooed on my body on race day - I'll share it on my YouTube and X accounts Bidding starts at $1,000. Each takeover doubles the price: $1,000 → $2,000 → $4,000. If outbid, you’re refunded minus the Stripe fee. Bidding closes on Thursday the 10th at midnight UTC (in 2 days), so I have enough time to print the winning tattoos. → Sponsor my body: hyrox.marclou.com

Introducing HumanPost — hire an army of Americans to post your TikToks. Get 10, 100, or 1,000 dedicated social accounts for your company. 🇺🇸 Run by real people in the US 🔥 Warmed up specifically for your niche 📱 Dedicated accounts just for your brand 🚫 Zero VPNs — we verify every operator You send us the content. We turn it into a distribution army. One brand. Hundreds of accounts. Thousands of posts. Welcome to HumanPost.

i grew up lower middle class in nigeria and became a millionaire within months of moving to america this video is extremely valuable

earlier this year i got dumped, sued by a huge american corporation and lost all my income in the same week. i was broke, depressed as fuck and scared of losing my apartment, but i was already five months into building levla so i felt like i had no choice but to lock in. a few months later i somehow sold the domain from my old business for $200K and launched levla on android. then this account started popping off and i met a bunch of great people on app twitter who made me want to push even harder. now levla is doing ~$15K/month after only 2 months on android. iOS isn't even live yet, and every day people tell me levla and its community are helping them change their lives. feeling hella blessed to be here & excited for what's to come. life can change stupidly fast. keep going gng

People are doubting that these are real numbers. Not sure what I can do to prove it to you, but here is a screenshot from my Polar dashboard.