WeWeb & Supabase - Security Concerns

[Max]

I don’t think it is a good idea to include Fastgen in the mix. Doing so will lead to the same issues: granting access to your database to an additional company. Fastgen lacks security certifications, and as far as I understand, they host their services in the US. This compromises Supabase’s SOC2 certification and does not comply with the EU’s data privacy regulations (GDPR).

Supabase is designed for frontend use. However, the issue is that WeWeb requires the service_role key for Auth plugin configuration. But as @Alexis mentions here, I believe this requirement can be made optional:

Control access to the Supabase Auth Config in editor for my team

About removing the toggle : yes that would be great I understand that it won’t prevent a sophisticated (or at least tech-informed) attack, but it’s already a great thing to prevent a too easy access to our service_role key ! I agree, I will ask the product team and see if we can make the change There is one point I’m not sure to get in your explanation : I get that the service_role key is used to both get / set users and roles, and also to get the information_schema fo…