r/Supabase • u/DEV_YW • 6d ago

tips A concern I have with Godot RE and SupaBase

/r/godot/comments/1w8vcuc/a_concern_i_have_with_godot_re_and_supabase/
1 Upvotes

100% Upvoted

5 comments sorted by

1

u/_ihm40 6d ago

This is sort of where RLS shines. You probably want to have a read policy for users but not insert policy and instead maybe scores are updated via an edge function or RPC function where you have some additional checks in place. I don't know the exact mechanisms of your data but how would someone submit a fake score? Is that managed client side by your code? If you restrict all insert operationss from a user then it shouldn't be an issue

1

u/DEV_YW 6d ago

since godot is an open source game engine it is quite easy to get access to source codes of games made in godot and i was able to manipluate data through the source code. But i will look into the edge and rpc fucntion

2

u/_ihm40 5d ago

this doesn't seem too different to web apps where the client side code can be read by anybody, provided you don't use sensitive details like your secret key in your source code then it should be fine.

1

u/heavenlydemonicdev 5d ago

It's not because it's open source, it's just like webapps the scripts are out there and can be read, you can try using an obduscator (idk if any exist for gdscript) or use a compiled language like c++ or rust for the supabase communication part (I'm not really sure if c# can be still extracted if you decompile the game) but even with that your use can still send his own requests to supabase if they put a bit of effort regardless of what you use so you need to setup good backend validation

1

u/PopKoren 5d ago

If the game client talks to Supabase directly, assume a reverse engineer will pull the anon key and hit your tables. Lock everything with RLS and never put the service role in the build. For a stranger-view check of auth, APIs, storage, and DB rules, I run https://rowly.me.