You're viewing DevMetrics as Supabase. Only Supabase data is in this security context. The session BFF reads an HttpOnly cookie, not the request body.
Supabase analytics
- PRs merged
- …
- Median PR cycle time
- …
- Median time to first review
- …
- Active contributors
- …
Switch customer: HashiCorp · Prisma · Supabase · Temporal · Vercel
Tenant isolation
Same dashboards. The BFF derives customerId from an HttpOnly cookie (customer) or sets skipTenantRls (internal). The forged body field is ignored.
Open a customer view first so the tenant cookie is set, then try forging another org id.
Internal operations · Public OpenDev