Terms
- RLS (Row Level Security): database rules deciding which rows each user may read or change. Without them, a public key can read the whole table.
- Service-role key: a Supabase key that bypasses all access rules. It must stay on the server, never in the browser.
- SSRF (Server-Side Request Forgery): tricking a server into fetching an address chosen by the attacker, often an internal one.
- CSP (Content-Security-Policy): a header telling the browser which scripts and resources a page may load, limiting injected code.
- Clickjacking: hiding your page inside another site’s frame to trick users into clicking. Blocked by frame-ancestors or X-Frame-Options.
- CORS: browser rules for which other sites may call your API. A wildcard with credentials is dangerous.
- IDOR: accessing another user’s data by changing an ID in a request because ownership is not checked.
- Prompt injection: text that makes an AI model ignore its instructions, reveal hidden context or misuse its tools.
- Referrer-Policy: a header controlling how much of your URL is sent to other sites when users follow a link.
- DMARC: an email record telling receivers what to do with mail that fails sender checks; p=none only monitors.