Onlook Design Updates: Closing a Major Security Gap
A single sweeping fix, merged today, closes a serious authorization gap where authenticated users could potentially read or modify other users' project data across nearly the entire tRPC API surface.
Duration: PT2M26S
Episode overview
This episode is a short developer briefing from Onlook Design Updates.
It explains recent repository work in plain language.
- Show: Onlook Design Updates
- Published: 2026-07-22T13:17:55Z
- Audio duration: PT2M26S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
You're listening to Onlook Design Updates for July 22nd, 2026.
Today's briefing centers on one change, and it's a significant one: a security fix that touches nearly every part of the backend API.
Here's the core issue. Onlook's database connects as a superuser that bypasses row-level security, which means access control has to be enforced in application code, not the database. A helper function for checking project access existed, but it was only applied to a handful of procedures. Everywhere else, the…
PR number 3129, from Mariano Rebord, closes that gap completely. It supersedes an earlier partial fix and audits the entire API surface, adding matching access-verification helpers for conversations, messages, branches, canvases, frames, invitations, sandboxes, deployments, and domain verifications. Every one of…
A few details worth remembering. Sandbox access has a carve-out: a sandbox not yet linked to a project — say, during a fresh create, fork, or import — is still allowed, so those flows keep working. Auth checks were also moved out of code that previously caught errors and silently returned false, so denials now…
The fix ships with nineteen unit tests covering the new helpers,…