Supabase Data Exposure: How Misconfigured AI-Generated Apps Are Leaking User Data

Supabase, the open-source Firebase alternative, has become a go-to backend for developers building modern applications. However, recent findings reveal that a number of its customers are inadvertently exposing reams of sensitive user data to the public web. The root cause: misconfigured and hastily built applications, particularly those generated by AI and 'vibe-coded' without proper security reviews.

The Rise of Vibe-Coded Apps and Security Gaps

Vibe coding—a trend where developers rely on AI to generate entire application stacks—has accelerated development but often bypasses essential security checks. When these apps connect to Supabase, default configurations or overlooked access rules can leave databases wide open. The result is that personal information, authentication tokens, and other private records become accessible to anyone with basic web knowledge.

What Exactly Is Exposed?

While the full scope is still being investigated, the exposures typically involve user tables that should be protected by row-level security (RLS) policies. Without RLS enabled or with overly permissive rules, Supabase's auto-generated APIs can serve data to unauthenticated requests. This means email addresses, hashed passwords, and even private messages could be at risk. The issue is not a flaw in Supabase itself, but rather a failure to follow best practices during development.

Supabase's Role and Recommended Actions

Supabase has consistently advocated for enabling RLS and using secure defaults. The company provides extensive documentation and tools to help developers lock down their databases. However, the platform cannot enforce these settings on behalf of its users. As AI-generated code becomes more prevalent, the burden falls on developers to audit their configurations before deploying to production. Supabase has not yet issued a specific statement about these exposures, but its community guidelines emphasize security-first development.

The Broader Implications for AI-Assisted Development

This incident underscores a growing concern: as AI tools make it easier to build and ship software, security often takes a back seat. Vibe-coded apps may function perfectly in testing but crumble under real-world scrutiny. Developers must treat security as a non-negotiable step, not an afterthought. For Supabase users, that means regularly reviewing RLS policies, monitoring access logs, and conducting penetration tests.

In conclusion, the exposures serve as a wake-up call for the no-code and AI-assisted development community. While Supabase offers robust security features, their effectiveness depends entirely on proper implementation. As the line between rapid prototyping and production blurs, prioritizing security from the start is essential to protect user trust and data.