DEV Community: Clément Creuzenet

The Supabase view Claude created that anyone could read

Clément Creuzenet — Mon, 09 Nov 2026 20:30:00 +0000

Claude Code created a view for me through an MCP SQL tool: a clean create view public.my_view as ..., no security_invoker.

A check found the problem the next day. The view was readable with the anon key, the one that ships in the frontend.

Why it happens

The tables had row level security. The view didn't care. In Postgres, a view runs with the rights of the user who created it, not the user who queries it. The creator was postgres, which bypasses RLS. And Supabase has long granted select on new objects in public to anon and authenticated by default. Its changelog announces a change for new tables from October 30, so check your project rather than trust either rule.

So a view in public without security_invoker is a hole straight through your policies. Claude knows this if you ask. It doesn't think about it while it's focused on making the dashboard work.

The fix is one option:

create view public.my_view
with (security_invoker = true) as
select ...;

The same trap exists with security definer functions in public (callable by anon unless you revoke execute), and with create table without enable row level security.

Catch it before it runs

If Claude talks to your database through an MCP tool, a PreToolUse hook sees every SQL statement before it's sent. A minimal version for the view case:

#!/usr/bin/env python3
import json, re, sys

event = json.load(sys.stdin)
sql = json.dumps(event.get("tool_input") or {})
for stmt in re.findall(r"create\s+(?:or\s+replace\s+)?view\s+[^;]+", sql, re.I):
    if re.search(r"\bpublic\.", stmt, re.I) and "security_invoker" not in stmt.lower():
        print("This view in public runs with its creator's rights and anon can read it. "
              "Add with (security_invoker = true).", file=sys.stderr)
        sys.exit(2)

Register it with "matcher": "mcp__.*" so it runs on MCP tool calls. Claude gets the reason and rewrites the statement with security_invoker.

What I use now

The snippet above closes the common case. A fuller version, which also catches views with no schema, quoted names and materialized views, is free in seatbelt-lite.

A Stop hook that checks Claude Code's "it's live"

Clément Creuzenet — Sat, 07 Nov 2026 20:30:00 +0000

"Deployed, it's live." Claude Code can say that right after the deploy command, with nothing checked since. It runs the command, sees output scroll by, and announces success without opening the URL.

This is the mistake I find hardest to catch, because it arrives at the end of the turn, when you're ready to believe it.

The Stop hook

Claude Code has a Stop event: it fires when Claude is about to end its turn and hand control back to you. A Stop hook can refuse, and Claude has to continue with the reason you gave.

The hook reads the session transcript (its path arrives in the event), and asks two questions:

Did a deploy command run during this turn? (vercel, wrangler deploy, netlify deploy, git push to a branch that deploys...)
After that, did anything check the result? (curl on the URL, vercel inspect, a browser visit, a status call)

If the answer to the first is yes, to the second no, and the last message contains "live" or "deployed", the hook blocks the stop:

#!/usr/bin/env python3
import json, re, sys

event = json.load(sys.stdin)
if event.get("stop_hook_active"):
    sys.exit(0)

lines = open(event["transcript_path"]).read().splitlines()
commands, last_text = [], ""
for line in lines:
    entry = json.loads(line)
    for block in (entry.get("message") or {}).get("content") or []:
        if isinstance(block, dict) and block.get("type") == "tool_use":
            commands.append(json.dumps(block.get("input")))
        if isinstance(block, dict) and block.get("type") == "text":
            last_text = block.get("text", "")

last_text = event.get("last_assistant_message") or last_text

deploy = [i for i, c in enumerate(commands) if re.search(r"vercel|wrangler\s+deploy|netlify\s+deploy", c)]
checked = deploy and any(re.search(r"curl|inspect|navigate", c) for c in commands[deploy[-1] + 1:])
if deploy and not checked and re.search(r"\b(live|deployed|en ligne)\b", last_text, re.I):
    print(json.dumps({"decision": "block",
                      "reason": "You deployed but never checked the result. Curl the URL or "
                                "read the deployment status before saying it is live."}))

stop_hook_active prevents a loop: if Claude is already continuing because of this hook, let it stop.

last_assistant_message is the part I got wrong first. When I ran this in a real session, Claude's final message hadn't reached the transcript yet when the hook ran, so the hook never fired. The event carries that message, and the transcript is only a fallback.

The version above reads the whole transcript to stay short. The one I run limits itself to the current turn, so an old deploy from an hour ago doesn't trigger it.

What changed

When Claude forgets to check, the hook sends it back before I read anything, and I get "HTTP 200, the new title is there" instead of "it's live". When the deploy did fail, I find out in the same turn instead of from a client.

The turn-scoped version is free in seatbelt-lite. The paid Seatbelt also counts git push and npm run deploy as deploys.

How to stop Claude Code from running git add -A

Clément Creuzenet — Fri, 30 Oct 2026 21:17:08 +0000

I had two Claude Code sessions open in the same repo. One was fixing a header, the other was halfway through a refactor. The first one finished, ran git add -A && git commit, and committed half of the refactor with it. Nothing was broken yet, but the history was, and untangling it took longer than the header fix.

My CLAUDE.md already said "add files by name, never git add -A". Claude followed it most of the time. Most of the time is the problem: a rule in a prompt competes with everything else in the context, and on a long session it loses sometimes.

A hook runs every time

Claude Code can run a script before each tool call. If the script exits with code 2, the call is cancelled and whatever the script printed on stderr goes back to Claude as the reason. Claude reads it and changes approach.

Here is the whole hook:

#!/usr/bin/env python3
import json, re, sys

event = json.load(sys.stdin)
cmd = (event.get("tool_input") or {}).get("command", "")
if re.search(r"\bgit\b[^;&|\n]*\badd\b[^;&|\n]*(\s-A\b|\s--all\b|\s\.(\s|$))", cmd):
    print("Seatbelt blocked this command: git add -A / git add . sweeps in .env files "
          "and other sessions' work. "
          "Add files by name.", file=sys.stderr)
    sys.exit(2)

Save it as ~/.claude/hooks/no_add_all.py and register it in ~/.claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "python3 ~/.claude/hooks/no_add_all.py" }]
      }
    ]
  }
}

Restart Claude Code. Next time it tries, you see this:

● Bash(git add -A && git commit -m "fix header spacing")
  ⎿ Seatbelt blocked this command: git add -A / git add . sweeps in
    .env files and other sessions' work. Add files by name.
● Bash(git add src/Header.tsx && git commit -m "fix header spacing")
  ⎿ [main 4e1c9a2] fix header spacing

Three details that matter

The message is for Claude, not for you. "Blocked" alone makes it retry the same thing or give up. "Add files by name" tells it what to do instead.
Test the pass cases too. git add .gitignore must go through. The \s\.(\s|$) part only matches a lone dot.
Exit code 2, not 1. Exit 1 shows an error to you and lets the command run.

The free version

I packaged this one with rm -rf ~ and force push as a plugin: seatbelt-lite, MIT, two commands to install.