Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
matt palmer Profile picture
@mattppal
Sep 13 • 5 tweets • 2 min read • Read on X
This week in Replit

Agent 3 is here! 🤖 Our AI is now more autonomous, reliable, and faster. It can test your app in a real browser, find bugs, and automatically fix them for you.
1/ Tackle bigger projects with longer run times. Agent 3 can now work autonomously for up to 200 minutes, with automated testing so you can track its progress.
2/ Ship faster with new App Connectors & Integrations. Connect your apps to your favorite services by signing in just once, and reuse the connection across all your projects.
3/ Build intelligent bots and workflows with Agents & Automations (beta). Create custom Slackbots, Telegram bots, or run tasks on a schedule, all from your workspace.
That's it for this week, be sure to follow along for weekly updates: docs.replit.com/updates

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with matt palmer

matt palmer Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @mattppal

matt palmer Profile picture
Jul 7
It's finally here!

You can now customize Agent in Replit. Here's how to get started 👇 Image
A file called 'replit.​md' now gets created in every Agent project. The purpose of replit.​md is twofold:

1/ Provide a concise summary of the project for Agent to reference as it builds
2/ Allow the user (you) to provide custom instructions to agent.

Here are some things you can customize:
Communication style: change how agent interacts, ask it to explain concepts, break down tasks, or ask for clarification. Image
Read 8 tweets
matt palmer Profile picture
Jun 1
you're thinking about vibe coding wrong

most of us approach vibe coding the same way we do other tools: like deterministic systems. press button and get result.

here's why that's wrong and how to get around it: Image
1/ We know AI is non-deterministic—that means that the same prompt can get different results.
2/ AI coding agents are composed of dozens or hundreds of calls to multiple AI models with a bunch of tools thrown in the mix.

That makes them ESPECIALLY random.
Read 13 tweets
matt palmer Profile picture
May 29
On March 20th, 2025, my colleague and I discovered a critical vulnerability in Lovable's implementation of Row Level Security (RLS) policies.

Applications developed using its platform often lack secure RLS configurations, allowing unauthorized actors to access sensitive user data and inject malicious data.

Lovable applications, being primarily client-driven, rely on external services for backend operations like authentication and data storage. This architecture shifts the security burden to the implementor of the application.

However, misaligned RLS policies between the client-side logic and backend enforcement frequently result in vulnerabilities, where attackers can bypass frontend controls to directly access or modify data.

Lovable later introduced a "security scanner," but it merely checks for the existence of any RLS policy, not its correctness or alignment with application logic. This provides a false sense of security, failing to detect the misconfigurations that expose data.Image
INITIAL DISCOVERY & SCOPE ASSESSMENT

The vulnerability was first identified on March 20th, 2025, while examining Linkable, a Lovable-built site for generating websites from LinkedIn profiles.

An inspection of network requests revealed that modifying a query granted access to all data in the project's "users" table. After we highlighted this on a reply on Lovable's Twitter account, Lovable denied the issue, then deleted their tweets and the site. Linkable was later reinstated with a $2 fee.

The core issue was not an exposed public API key as we initially thought (Supabase provides public `anon` keys by design) but the absent RLS configuration. This allowed unrestricted data retrieval from the exposed table (sample in Appendix A1).

To determine if this was an isolated incident, we investigated other Lovable-created sites, starting with those on Lovable Launched—a showcase presumably featuring polished projects.

Access to the list of these sites was gained by manipulating an endpoint on the Launched site itself, which also lacked RLS.

We then developed a script to visit the homepage of each Launched site, capture all external network requests, and filter for those made to external sources.

For each identified request, the script attempted to modify the request to select all data from the associated endpoint—an operation equivalent to `SELECT *`, which RLS would typically prevent.Image
AUTOMATED SCAN FINDINGS

The scan, completed on March 21st, identified 303 endpoints across 170 projects (approximately 10.3% of the 1645 analyzed) with inadequate RLS settings. This indicates widespread RLS misapplication, potentially highlighting systemic issues in Lovable's platform that may predispose projects to insecure data storage.

The following anonymized public endpoints from the scan illustrate the types of sensitive data exposed:

/functions/v1/get-google-maps-token
/rest/v1/rpc/get_gemini_api_key
/functions/v1/refresh-ebay-token
/rest/v1/users
/rest/v1/transactions
/rest/v1/subscriptions

This script only analyzed homepages and did not attempt to access login-protected areas or perform deeper site scraping. Authenticated sessions on these vulnerable sites could expose even more sensitive data.

Users interacting with Lovable-built sites should exercise extreme caution in the data they submit.Image
Read 8 tweets
matt palmer Profile picture
May 8
Announcing our newest Replit integration: Notion
1/ Now you can build Notion-powered apps in minutes with Replit.
2/ Pull data from Notion data or push it. If you're really feeling crazy, you could do both. 🤪 Image
Read 6 tweets
matt palmer Profile picture
Apr 30
Whether you're using Replit Agent, Assistant, or other AI tools, clear communication is key.

Effective prompting isn't magic; it's about structure, clarity, and iteration.

Here are 10 principles to guide your AI interactions: Image
Checkpoint: Build iteratively. Break large goals into smaller, testable steps. Use features like Replit Agent's Checkpoints to save progress and experiment safely.
Debug: Don't just say "it's broken." Give the AI context: exact error messages, relevant code snippets, and the steps you took. Help it help you.
Read 12 tweets
matt palmer Profile picture
Apr 29
Level up your prompts: 5 prompt examples & explanations for tools like Replit Agent and Assistant.

The quality of your prompts directly impacts the results.

Vague requests lead to vague outcomes. Clear, specific instructions unlock the AI's full potential. [ 🧵 ] Image
Bad: "Fix my code."

Good: "My script fails on user input validation. Debug the validate_input function. Error: [details]"

Why it works: Specificity! Pinpoint the problem area & provide
Bad: "Make a website."

Good: "Create a portfolio site: Home, About, Contact Form. Use a modern theme & placeholder content."

Why it works: Clarity! Define the scope, core features, and desired style. Don't leave the AI guessing.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(