Aafiaga o le Tagata osofa'i
E mafai e se tagata osofa'i ona maua avanoa e le'i fa'atagaina i fa'amatalaga ma'ale'ale a tagata fa'aoga, suia fa'amaumauga o fa'amaumauga, po'o le faoa o mea tetele e ala i le fa'aogaina o va'aiga masani i fa'agaioiga MVP. E aofia ai le fa'aogaina o fa'amaumauga o tagata mautotogi ona o le misia o fa'atonuga avanoa [S4] po'o le fa'aogaina o ki API ua liki e fa'atupu ai tau ma fa'amama fa'amaumauga mai auaunaga tu'ufa'atasi [S2].
Mafua'aga
I le fa'anatinati e fa'alauiloa se MVP, o tagata atia'e-aemaise i latou o lo'o fa'aogaina le AI-fesoasoani "vibe coding" -e masani ona le amana'ia fa'atonuga fa'avae. O mafuaʻaga autu o nei faʻafitauli o:
- Fa'alilo Leaka: Fa'ailoga, e pei o fa'amaumauga fa'amaumauga po'o AI ki e tu'uina atu, e fa'afuase'i ona tu'u atu ile fa'atonuga ole [S2].
- Broken Access Control: Ua le mafai e tusi talosaga ona fa'amalosia tapula'a sa'o fa'atagaina, fa'atagaina tagata fa'aoga e maua ai punaoa a isi [S4].
- Faiga Fa'amatalaga Fa'ataga Fa'amatalaga: I fa'aonaponei BaaS (Backend-as-a-Service) setups pei o le Supabase, ua le mafai ona fa'aogaina ma fa'aoga sa'o le Row Level Security (ZXCVFIXVIBETOKEN2ZX viaCV) tu'u sa'o le fa'amatalaga fa'amatalaga tu'u sa'o i le tagata o tausia [S5].
- Vavavale Fa'ailoga Fa'ailoga: Le lelei le fa'aogaina o fa'ailoga fa'amaonia e mafai ona ta'ita'iina ai le fa'agaoioiga po'o le API le fa'atagaina avanoa [S3].
Fa'atonu Sima
Fa'atino Saogalemu Tulaga Laila (RLS)
Mo talosaga e fa'aoga Postgres-fa'avae pito i tua e pei o le Supabase, RLS e tatau ona fa'aogaina i luga o laulau uma. RLS fa'amautinoaina o le afi fa'amaumauga lava ia e fa'amalosia ai fa'agata avanoa, e taofia ai se tagata fa'aoga mai le fesiligia o fa'amatalaga a le isi tagata e tusa lava pe iai sa latou fa'amaoniga fa'amaonia [S5].
Fa'autometi le Su'ega Fa'alilo
Fa'atasi le su'esu'ega faalilolilo i totonu ole su'esu'ega tau atina'e e iloa ma poloka le tuleia o fa'ailoga ma'ale'ale e pei o API ki po'o tusipasi [S2]. Afai e lia'i se mealilo, e tatau ona soloia ma fesuia'i vave, aua e tatau ona manatu e fetuutuuna'i [S2].
Fa'amalosia Faiga Fa'ailoga Fa'amalo
Mulimuli i tulaga tau alamanuia mo le saogalemu o faailoga, e aofia ai le faʻaogaina o kuki malupuipuia, HTTP-naʻo le pulega o sauniga ma faʻamautinoaina o faʻailoga e faʻapipiʻiina pe a mafai e taofia ai le toe faʻaaogaina e tagata osofaʻi [S3].
Fa'aoga Ulua'i Saogalemu Lautele
Ia mautinoa o loʻo faʻatinoina e le talosaga faiga faʻapitoa mo le saogalemu o le upega tafaʻilagi, e pei o le Content Security Policy (CSP) ma faʻamautu faʻasalalauga felauaiga, e faʻaitiitia ai osofaʻiga masani a le browser [S1].
Fa'afefea ona su'e le FixVibe
O le FixVibe ua uma ona ufiufi lenei vasega-leak class i luga o le tele o faʻataʻitaʻiga mataʻitusi luga:
- Supabase RLS fa'aalia:
baas.supabase-rlssi'isi'i fa'alaua'itele Supabase URL/non-key paiga mai fusi e tasi, faitau fa'amatalaga fa'aalia ma fa'agasolo le laulau fa'atino pe fa'aalia fa'amatalaga laulau. - Repo RLS gaps:
repo.supabase.missing-rlstoe iloilo faatagaina GitHub teuina SQL femalagaiga mo laulau lautele e faia e aunoa ma seALTER TABLE ... ENABLE ROW LEVEL SECURITYfemalagaiga tutusa. - Supabase tulaga e teu ai:
baas.supabase-security-checklist-backfilltoe iloilo metadata o pakete Teuina mo tagata lautele ma le le faailoaina o le lisi e aunoa ma le faʻapipiʻiina pe suia faʻamatalaga tagata faʻatau. - O mealilo ma le tulaga o le su'esu'e:
secrets.js-bundle-sweep,headers.security-headers, ma leheaders.cookie-attributesfu'a na sasaa ai fa'amatalaga a le tagata o tausia, misi ulutala fa'ama'a'a o su'esu'ega, ma fu'a auth-kuki vaivai. - Su'esu'ega fa'atonutonu fa'avanoa: pe a fa'atagaina e le tagata fa'atau su'esu'ega ma fa'amaonia le pule o le fanua, su'esu'e a le
active.idor-walkingma leactive.tenant-isolationna maua ai auala mo IDOR/BOLA-style cross-resource ma fa'amatalaga fa'amaumauga a tagata mautotogi.
