Close an open Supabase database
16,000+ Supabase databases exposed through vibe-coded apps · Security incident · X · @IBthecoder · Sep 2026
Researchers reported more than 16,000 Supabase databases reachable through vibe-coded apps, over half showing signs of personal data.
Lesson
Enable Row Level Security on every table and test reads with only the anon key and no login.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
My app uses Supabase (or Firebase) and I built it with Supabase. Please check whether my database is open to anyone. 1) List every table and storage bucket and whether Row Level Security (or security rules) is enabled. 2) For each table, explain who can read and write it now, in plain English. 3) Propose the minimum policies so users only see their own rows, public content is read-only, and plan, role or credit columns can't be changed by users. 4) Give me the SQL or rules to apply, and a test with two accounts and a logged-out browser. Don't use or ask for the service_role key. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: X ↗