My family just became a statistic. A close relative is in a skilled nursing facility right now. And in the days since he was admitted, we’ve discovered something humbling — for a family that considers itself organized, we were completely unprepared. 🧵

verify_jwt is not a security switch. On is not "safe." Off is not "public by design." If you vibe-coded Supabase edge functions, this is the one to get right. verify_jwt = true means the platform checks that Authorization holds a valid JWT before your function runs. That is authentication: a token verified. It does not mean this user is allowed to do this action. A normal logged-in user's token passes. If the function then does admin work (change a role, mint a grant, delete an org) and never checks who, every authenticated user can fire it. Valid token ≠ authorized. verify_jwt = false means the platform does not check for a user JWT. Every request that reaches the function runs your code. That is what you want for a webhook or a genuinely public route - the caller is not a Supabase user. It is not a gate. If the function does not verify a signature or a secret, anyone who can invoke it can run it. The publishable key already ships in the browser, so "can invoke it" is not a meaningful lock. Two different holes: (a) true + no in-function authorization >> any logged-in user hits privileged work; (b) false + no in-function gate >> anyone who can invoke the URL runs it, and the publishable key is not a lock verify_jwt is transport. Authorization is your job, in the function. What a real gate looks like: Webhook >> verify the provider's signature (constant-time compare, not === on the header) User action >> getClaims(), then role or ownership Service-to-service >> shared secret, same constant-time compare For each function: is it meant to be public? If not, is there a check in the source, not just the toggle? If it is a webhook, is the signature verified? "We set verify_jwt and moved on" is the gap. The Security Advisor will not see it. It does not read your functions. The test is to call the function as the wrong person.

If you vibe-coded on Supabase and the Security Advisor is green, that is not proof the app is closed. It is proof the lint passed. Here is the gap, and the smallest test that actually counts.

Changed a little bit of everything here - PFP, bio... Not because I've changed, but because of what hasn't. I'm (and I dare to say "we" as a family) are really proud of what we did with Latino Society and related work. Met tons of lovely people around the world (perhaps the most impactful thing, bar none), lots of lessons learned. One of them is in the bio now: if you're going to fail, fail fast. This is a constant reminder now. This "pause" helped us grow stronger, more focused, more clinical, and with more drive to do better - that 1% better every day. It's a thing. I appreciate each and every one of y'all that has stayed in touch with us, and I look forward to continue sharing what we're building. Onward.

De Nederlandse huurmarkt is kapot. Niet kapot in de zin van "het kan beter." Kapot in de zin van: een kamer in Amsterdam trekt 200 sollicitaties in 48 uur. Huurders sturen dezelfde loonstroken, bankafschriften en ID-bewijzen naar tientallen verhuurders. Steeds opnieuw. Naar mensen die ze niet kennen. Makelaars verdrinken in documenten die ze handmatig moeten verifiëren, terwijl de GDPR-klok tikt. En aan het einde van dat proces? Iemand krijgt de woning. De rest begint opnieuw. Wij bouwen een geverifieerd huurdersprofiel dat je één keer aanmaakt en overal deelt. Jij bepaalt wat er in staat. Jij bepaalt wie het ziet. Meer binnenkort.