SupaPwn: Hacking Our Way into Lovable's Office and Helping Secure Supabase

Masterclass with Supabase's Bill Harmer and Lovable's Igor Andriushchenko on keeping velocity without losing control as AI accelerates shipping: build security in from the start and add guardrails.

Fuzzing Android devices uncovered CVE-2016-3861 in libutils, a severe bug reachable from many attack vectors and usable for remote code execution and elevation into the system_server SELinux domain.

We could have pwned every Metabase Cloud tenant by chaining an H2 INIT sanitizer bypass into RCE, then cloud misconfigurations into a full multi-tenant cluster compromise.

A logic bug in readline leaks partial file contents when parsing the INPUTRC environment variable, exploitable via SUID binaries like chfn for lateral movement; reported and patched in February 2022.

A tutorial on phone authentication using Twilio with Next.js and Supabase, extending earlier auth coverage and doubling as a common two-factor authentication pattern for consumer applications.

A hands-on tutorial by Telmo Goncalves showing how to build a Next.js app and implement authentication with Supabase, covering project setup, TailwindCSS styling, and row-level security.