RLS Before Launch: The Supabase Lesson

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-vibecoder-rls-before-launch

1. What is Row Level Security (RLS) in Supabase?

   1. A type of encryption that protects data at rest
   2. A database feature that restricts which rows a user can read, write, or update based on conditions you define
   3. A tool that automatically generates SQL queries for your application
   4. A setting that makes your entire database publicly accessible

2. Why does the lesson warn that 'vibe-coding' security stories rarely involve genius hackers?

   1. Because most real hackers use social engineering instead of technical exploits
   2. Because Supabase has unbreakable encryption by default
   3. Because AI-generated apps often have public database access due to missing or weak RLS policies
   4. Because teenagers cannot actually hack anything

3. What does it mean to 'run the result as a user, not as a fan of the tool'?

   1. Share the app with friends and ask for feedback
   2. Only test features that the tool advertises as working
   3. Test the app while pretending to be a developer who built it
   4. Test the app from the perspective of someone who has no special permissions or knowledge

4. What does it mean to 'write the smallest useful scope the agent can finish'?

   1. Write the briefest possible prompt regardless of whether it produces working code
   2. Create the smallest database table possible
   3. Tell the AI to build an entire production-ready application in one go
   4. Break the task into the smallest pieces that still result in something usable and testable

5. What should happen BEFORE sharing an AI-generated app with real users?

   1. Post it on social media to generate excitement
   2. Make sure the app looks polished and professional
   3. Ask the AI if the code is secure
   4. Inspect the diff, verify data access controls, and test failure paths

6. Which statement best describes why RLS should be treated as 'part of the product, not an afterthought'?

   1. RLS is only needed for apps that store sensitive information
   2. Security bugs can expose user data, damage trust, and may cause legal issues — they need the same attention as features
   3. Supabase requires RLS to be enabled before you can use the database
   4. RLS policies are fun to write and developers enjoy creating them

7. What is a 'failure path' in the context of database security testing?

   1. The process of rolling back a bad database migration
   2. What happens when a user tries to access data they should not have access to
   3. The error messages your app displays
   4. The backup system you use when the database crashes

8. What is a rollback path in the context of AI-generated database changes?

   1. The route users take when they want to delete their accounts
   2. A way to revert database changes if the AI outputs something dangerous or incorrect
   3. The process of downgrading your Supabase plan
   4. A feature that automatically undoes user actions

9. Why do Lovable and Supabase communities warn that generated apps can 'look finished' while having security issues?

   1. Because AI is perfect and only makes visual mistakes
   2. Because testing is optional in modern web development
   3. Because they want users to buy expensive security plugins
   4. Because the app can function normally while accidentally exposing data that users cannot see

10. What does inspecting the 'diff' help you verify about an AI-generated app?

    1. How many lines of code were generated
    2. What code changes the AI actually made versus what you expected
    3. Whether the UI looks consistent across pages
    4. Whether the app loads quickly

11. What test proves that RLS policies are working correctly?

    1. The app responds quickly to requests
    2. Multiple users can log in successfully
    3. A user account without admin privileges cannot access another user's private data
    4. The app compiles without errors

12. The lesson says 'real skill is turning that demo into something observable, reversible, and safe enough for another person to use.' What does 'observable' mean in this context?

    1. The code is easy for developers to read
    2. The app can be monitored by analytics tools
    3. You can see and verify how the system behaves and what data it exposes
    4. The app has a beautiful user interface

13. What happens if you deploy an AI-generated app without proper RLS policies?

    1. The app will run slower
    2. The app will not load for users
    3. Users will see a warning message
    4. Any user could potentially read or modify data they should not have access to

14. What is a 'database policy' in the context of Supabase?

    1. A rule that defines who can select, insert, update, or delete rows in a table
    2. A document that explains how to use the Supabase dashboard
    3. A backup schedule for your database
    4. A setting that optimizes query performance

15. Why is it important to define what users should be able to do BEFORE building an AI-generated app?

    1. So the app will be free
    2. So you can verify the AI actually implemented the correct permissions and access controls
    3. So you know which colors to use
    4. So you can write longer prompts