[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-some-supabase-apps-are-leaking-user-data-to-the-open-web":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},7964,"some-supabase-apps-are-leaking-user-data-to-the-open-web","Some Supabase Apps Are Leaking User Data to the Open Web","Some Supabase-hosted apps left user data publicly accessible, showing how AI-assisted coding can outpace basic security hygiene.","A batch of apps built on Supabase are broadcasting their users' personal data to anyone who looks.\n\nThe exposure comes down to basic misconfiguration, not a flaw in Supabase's own platform. The affected apps simply weren't set up or secured properly, leaving data that should have stayed private sitting in the open on the public web. Many of the apps involved were AI-generated or vibe-coded, built quickly with AI coding assistants rather than a careful security pass. The findings describe the leaked data as reams of it, not a handful of stray records.\n\nThis is the security tax nobody budgets for with vibe coding: tools that make it trivial to spin up a working app rarely make it just as trivial to lock down the data behind it. Supabase has become a default backend for AI-assisted builders because it strips out the friction of standing up a database and authentication layer - but stripping out friction also strips out the moment a developer might stop and ask who can actually see this.\n\nCall it the honor system for permissions: skip the setup, and the internet eventually finds out anyway.","[\"supabase\",\"data exposure\",\"vibe coding\",\"security\"]","2026-09-25T17:29:46.000Z","2026-09-26T09:13:11.704Z","2026-09-26T09:13:19.849Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The claim that a single unchecked row-level-security setting is the specific misconfiguration mechanism is not supported by the source material (which only says apps weren't 'configured or secured properly') — either verify this detail against additional reporting or generalize the language so it doesn't assert a specific unverified technical cause.","resolved","security",[32,33,34,30],"supabase","data exposure","vibe coding",[36],{"name":37,"url":38},"TechCrunch","https:\u002F\u002Ftechcrunch.com\u002F2026\u002F09\u002F25\u002Fsome-supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web\u002F",0,{"sections":41},[42,47,51,56,61,66,70,75,80,85,90,95,100,105],{"name":43,"slug":44,"count":45,"latest_published_at":46},"AI","ai",4624,"2026-09-25T21:57:05.000Z",{"name":48,"slug":30,"count":49,"latest_published_at":50},"Security",748,"2026-09-26T01:30:00.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",392,"2026-09-25T18:44:30.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Deals","deals",258,"2026-09-26T09:00:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",185,"2026-09-25T15:00:22.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":60},"Science","science",144,{"name":71,"slug":72,"count":73,"latest_published_at":74},"Consumer Tech","consumer-tech",133,"2026-09-26T07:30:06.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Software","software",90,"2026-09-25T20:55:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Dev Tools","dev-tools",84,"2026-09-26T04:20:58.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Startups","startups",76,"2026-09-25T18:33:59.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Gaming","gaming",48,"2026-09-25T18:35:21.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"General","general",46,"2026-09-25T02:12:57.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Reviews","reviews",30,"2026-09-24T20:07:31.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]