5 ms·
Database still support RAW queries. So, yeah developer are responsible for proper usage of the tools.
by blackoil 1y ago
Database still support RAW queries. So, yeah developer are responsible for proper usage of the tools.
- ajross 1y agoThere are whole ecosystems of tools designed around the need to isolate queries, though. You don't just throw a Postgres prompt at your developers and tell them to be careful, because if you do little Bobby Tables pwns your stuff. We know this is how this works. We lived through it. Why on earth do you think the results will be any different this time?
- fastball 1y agoDatabase providers do just throw a postgres prompt at developers though, right? And that is what Supabase is – an infra provider.
- ajross 1y agoThat's an argument, I guess, for absolving Supabase for explicit responsibility for the resulting hilarity. It's not an argument that MCP prompt hacking is "not a serious security hole", which is the point I responded to upthread.
- fastball 1y agoIt's only a security hole if you give access to users though, right? If you are the one using the Supabase MCP, how is it any different than any other root access to a DB?
- simonw 1y agoBecause of lethal trifecta attacks: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ If you are the person using the LLM tool, a prompt injection attack in a database row that you are allowed to view could trick your LLM tool into taking actions that you don't want it to take, including leaking other data you are allowed to see via writing to other tables or using other MCP tools.
- fastball 1y agoGood point. I suppose the answer here then is to not allow the Supabase MCP any exfiltration pathways.