A batch of apps built on Supabase are broadcasting their users' personal data to anyone who looks.
The exposure comes down to basic misconfiguration, not a flaw in Supabase's own platform. The affected apps simply weren't set up or secured properly, leaving data that should have stayed private sitting in the open on the public web. Many of the apps involved were AI-generated or vibe-coded, built quickly with AI coding assistants rather than a careful security pass. The findings describe the leaked data as reams of it, not a handful of stray records.
This is the security tax nobody budgets for with vibe coding: tools that make it trivial to spin up a working app rarely make it just as trivial to lock down the data behind it. Supabase has become a default backend for AI-assisted builders because it strips out the friction of standing up a database and authentication layer - but stripping out friction also strips out the moment a developer might stop and ask who can actually see this.
Call it the honor system for permissions: skip the setup, and the internet eventually finds out anyway.