{
  "id": 3326306,
  "title": "From community review to a shipped security hardening with Codex",
  "url": "https://urgent.news/2026/08/25/from-community-review-to-a-shipped-security-hardening-with-codex",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-25T18:24:37.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/oitydobcrypto/from-community-review-to-a-shipped-security-hardening-with-codex-3g1p"
  },
  "original_language": "en",
  "account": "A small open-source TypeScript toolkit called Tenant Evidence Kit was developed to handle private, multi-tenant evidence workflows on Supabase. The project's origin was a specific need to attach photos, documents, or other evidence to business objects without compromising security. The toolkit maintains a small infrastructure and is domain-agnostic, providing features such as private Supabase Storage, evidence metadata separation from file bytes, tenant isolation with Row Level Security, short-lived signed URLs, and cleanup processes in case metadata persistence fails.\n\nWhen releasing the toolkit, a community review found several issues related to authorization, deletion, and the lack of UPDATE support. To address these concerns, the project underwent a review loop in which Codex, an AI agent, was used to implement the identified improvements. The workflow involved receiving a community review, turning the feedback into a scoped issue, having Codex implement the solution, undergoing a human review, making corrections, passing through CI, and finally releasing the updated version.\n\nThe first implementation introduced operation-specific evidence permissions, restricted evidence deletion to owners and admins, preserved existing read/create behavior for active members, made evidence metadata explicitly append-only, and added a separate migration for existing installations. Additionally, real Supabase/pgTAP authorization tests, CI coverage for database authorization, and explicit documentation of the RLS execution boundary were included. Storage and Postgres now share the same permission model for evidence operations.\n\nThe goal was not to create a large authorization framework but to make the existing security boundary more explicit, testable, and upgrade-safe. The author learned that giving the agent a reviewable engineering boundary made the task easier to evaluate. Despite the agent's contribution, the human review step remained crucial.",
  "summary": "I’ve been building a small open-source TypeScript toolkit called Tenant Evidence Kit for private, multi-tenant evidence workflows on Supabase. The project started from a very specific problem: How do you attach photos, documents, or other evidence to a business object without making files public, leaking tenant data, or duplicating authorization logic across the application? The toolkit keeps…",
  "key_points": [
    "Community review identified authorization and deletion issues in Tenant Evidence Kit",
    "Codex AI agent implemented improvements to address identified issues",
    "Human review step remained crucial despite agent's contribution"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}