Close an open Supabase database
Researchers reported more than 16,000 Supabase databases reachable through vibe-coded apps, over half showing signs of personal data.
Open database rules
Supabase/Firebase apps without row-level security expose every row to anyone with the public key. Turn on RLS and test with a second account.
4 items · 0 stories · 4 security incidents
Keep agent tokens out of public database tables
Wiz found the AI-agent social network Moltbook running a Supabase backend whose public key allowed reading the database, exposing large numbers of agent API tokens and user data. It was fixed after disclosure.
Lock down file storage holding user uploads
Selfies and driver's license photos from users of the Tea dating-safety app were posted on 4chan after the app's stored images were left exposed.
Turn on RLS in a Lovable + Supabase app
Two researchers scanned 1,645 showcased Lovable apps and found 303 Supabase endpoints in 170 projects readable or writable without login, exposing emails, payment details and API keys.