Skip to content

🛡️ Security Release v1.2.0

Choose a tag to compare

View all tags
@laminko laminko released this 21 Jun 09:50
· 30 commits to dev since this release
v1.2.0
58934ad
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🛡️ Security Release v1.2.0

🚨 Critical Security Fix

This release addresses a critical security vulnerability in the Row Level Security (RLS) policies that allowed anonymous users to access each other's spending data.

Security Issue Fixed

  • CVE: Cross-user data access vulnerability in RLS policies
  • Impact: Anonymous users could access ALL other anonymous users' spending data
  • Severity: Critical
  • Resolution: Fixed RLS policies and standardized authentication

Changes Made

🔒 Security Improvements

  • Fixed RLS policies: Removed dangerous user_id LIKE 'anon_%' wildcard conditions
  • Proper user isolation: RLS policies now use exact JWT-based user matching only
  • Standardized authentication: Removed client-side user ID generation entirely
  • Eliminated localStorage manipulation: No more client-controlled user IDs

🏗️ Authentication Refactor

  • Supabase-only auth: Uses only Supabase's built-in anonymous authentication
  • Proper session management: Improved session validation and restoration
  • Better error handling: Proper exception throwing and error management
  • Removed fallbacks: No more dangerous client-side ID fallbacks

Breaking Changes

⚠️ Existing anonymous users will need to re-authenticate

  • Users with local anon_* IDs will be required to create new anonymous sessions
  • This is intentional to ensure all users have proper Supabase sessions
  • No data will be lost - users just need to refresh the app

Migration Guide

  1. For existing users: Simply refresh the app - a new anonymous session will be created automatically
  2. For developers: Update your Supabase RLS policies if you've customized them
  3. Database updates: Run the updated SQL policies from SUPABASE_SETUP.md

Files Changed

  • SUPABASE_SETUP.md - Updated with secure RLS policies
  • src/composables/useAuth.ts - Completely refactored authentication logic
  • package.json - Version bump to 1.2.0

Verification

  • ✅ Build passes without TypeScript errors
  • ✅ RLS policies properly restrict data access
  • ✅ Authentication flow works with Supabase anonymous auth only
  • ✅ Rate limiting research completed for future abuse prevention

Related Issues

  • Fixes #35 - Critical RLS vulnerability
  • Implements security recommendations from Supabase database advisor

⚠️ IMPORTANT: Please update your Supabase database policies immediately using the SQL from SUPABASE_SETUP.md to ensure the security fix is applied.

🤖 Generated with Claude Code

Assets 2
Loading