Keep agent tokens out of public database tables
Moltbook's exposed database leaked agent API tokens · Security incident · Hacker News · wiz_io · Feb 2026
Wiz found the AI-agent social network Moltbook running a Supabase backend whose public key allowed reading the database, exposing large numbers of agent API tokens and user data. It was fixed after disclosure.
Lesson
A public Supabase key is only safe with strict RLS on every table. See common AI security mistakes.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
My app uses Supabase (or Firebase) and I built it with Supabase. Please check whether my database is open to anyone. 1) List every table and storage bucket and whether Row Level Security (or security rules) is enabled. 2) For each table, explain who can read and write it now, in plain English. 3) Propose the minimum policies so users only see their own rows, public content is read-only, and plan, role or credit columns can't be changed by users. 4) Give me the SQL or rules to apply, and a test with two accounts and a logged-out browser. Don't use or ask for the service_role key. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Hacker News ↗