CourseMate
Study groups for Waterloo students taking the same courses.
- 01Email sign-in with Supabase Auth
- 02Postgres model: profiles, courses, groups, memberships
- 03Row-level security guards every row
Put security where the data lives. RLS checks every query inside Postgres, so the UI never has to be trusted.
ProblemClient-side permission checks can be bypassed.
FixMoved authorization into PostgreSQL RLS policies keyed on auth.uid().
- Next.js
- Supabase
- PostgreSQL
- Vercel