bookly-sample

Text a visitor types is pasted straight into a database command, which can let them read or delete data they should not reach.

What to do: Pass every value as a query parameter instead of joining it into the SQL text.

const rows = await db.query(`SELECT * FROM bookings WHERE customer_name = '${name}'`)

A password, token or API key sits in the source code. Anyone who can see the code -- a past freelancer, a leaked copy -- can use it.

What to do: Move it to an environment variable, then revoke the old key where it was issued and create a new one.

const ADMIN_PASSWORD = 'book…'

The app has a database function that runs whatever SQL it is given, and the website calls it with the public key every visitor has. Anyone can use it to read, change or delete all data.

What to do: Remove the function from the database now. Replace each use with a specific, limited function or a normal query that row-level security protects.

return supabase.rpc('exec_sql', { sql })

create or replace function public.exec_sql(sql text) returns void language plpgsql security definer as $$ begin execute sql; end $$;

Settings starting with VITE_, NEXT_PUBLIC_, REACT_APP_ or EXPO_PUBLIC_ are copied into the website itself, so anyone can read these keys in their browser and use them -- running up your bill or reaching your data.

What to do: Move the call that needs the key to a server function, keep the key there without the public prefix, and replace the exposed key.

const openai = new OpenAI({ apiKey: import.meta.env.VITE_OPENAI_API_KEY, dangerouslyAllowBrowser: true })

VITE_OPENAI_API_KEY=sk-p…

The service_role key bypasses every database rule. Anyone who sees it -- in the code, a leaked copy, or the browser -- can read and change all data.

What to do: Revoke it in Supabase now, keep the new one only on the server (an environment variable), and use the anon key in the app.

const SUPABASE_KEY = 'eyJ…

These Supabase tables are created without row-level security, so anyone with the public key -- which every visitor's browser has -- can read, and often change, every row. (Unless it was switched on later in the Supabase dashboard: worth checking there.)

What to do: Enable row-level security on each table and add policies that let people see only their own rows.

create table public.bookings (

These files hold passwords or keys and are part of the repository, so every copy of the code carries them.

What to do: Remove them from git, add .env to .gitignore, and replace every key they contained.