Defense-in-Depth in a Tiny Supabase App: 5 Patterns I Baked Into Altair Before Open-Sourcing It
I open-sourced a Professional Services Automation (PSA) tool last week. Before I flipped the repo public, I had to convince myself that someone forking it without reading every line couldn't accidentally ship a security hole. The data this thing holds — consultant cost rates, client SOWs, revenue forecasts, who reports to whom — is the kind of stuff that, if it leaks, ends careers.
What made me comfortable hitting the visibility flip was that the auth model didn't depend on any single layer doing its job. Five patterns, layered. Below is each of them, with the actual code, the failure mode each one prevents, and the one place I almost shot myself in the foot.
TL;DR for skimmers:
• Edge middleware does a JWT presence check on every /api/* request
• Every handler is wrapped in withAuth() — no exceptions, enforced by CI
• Writes go through authed RPCs that...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
