Hack yourself
before someone
else does.

Fix a security issue in this app. Do not change anything else.

Problem: the "profiles" table in Supabase has Row Level Security turned off,
so anyone with the public anon key can read every row.

Do this:
1. Enable RLS on public.profiles.
2. Add a policy so users can only select and update their own row:
   using (auth.uid() = id)
3. Make sure no frontend code relies on reading other users' profiles.

When you're done, list the SQL you ran.

In next.config.ts, add security headers for every route.

Add an async headers() returning, for source "/(.*)":
- Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy: camera=(), microphone=(), geolocation=()
- X-Frame-Options: DENY

Keep existing config. Don't add packages.

import type { NextConfig } from "next";

const securityHeaders = [
  { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
  { key: "X-Frame-Options", value: "DENY" },
];

const config: NextConfig = {
  poweredByHeader: false,
  async headers() {
    return [{ source: "/(.*)", headers: securityHeaders }];
  },
};
export default config;

fix(security): enable RLS on profiles  (#42)Opened by Emerald Red Team · ERT-BAAS-001 + alter table public.profiles enable row level security;+ create policy "own profile" on public.profiles+   for select using (auth.uid() = id);+ create policy "update own profile" on public.profiles+   for update using (auth.uid() = id); Verification: re-scan after merge confirms the tableno longer answers anonymous requests.