marklok is closing the back door between browser and database

Previously, marklok's fork let the browser query and update user profile records directly in Supabase, the hosted database service the project runs on. That pattern leans entirely on database-level rules to stop a clever user from writing fields they shouldn't. The new approach routes profile changes through a backend endpoint with an explicit list of what can be changed - a meaningful tightening for any product that handles sensitive client data.

Two caveats the team will want to revisit: the allowlist accepts users' personal AI API keys, which means those secrets could quietly land in server logs unless scrubbed; and it lets the client edit its own credit-usage counter, which a determined user could exploit to dodge billing limits. Worth watching whether marklok keeps narrowing what the browser is allowed to touch directly.