Use Supabase MCP read-only and away from production
Supabase MCP could leak an entire SQL database · Security incident · Hacker News · generalanalysis · Jul 2025
Researchers showed that a prompt hidden in a customer support ticket could make a coding agent, running Supabase MCP with the service_role key, read private tables and post them back into the ticket.
Lesson
Use read-only and project-scoped MCP access and never give an agent the service_role key while it reads user-written content.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I use Supabase MCP, which can read web pages, files, emails or tool output. Help me reduce the risk of prompt injection (hidden instructions in content the AI reads). 1) List what my setup can access (files, terminal, browser, MCP servers, email, databases) and what it can do without asking me. 2) Point out the riskiest combinations, e.g. reading untrusted content while also having access to secrets or the ability to send data out. 3) Suggest concrete settings: require approval for commands and network calls, remove MCP servers I don't need, use read-only tokens, and keep the tool updated. 4) Give me a short checklist to follow before opening untrusted repos or documents. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Hacker News ↗