Supabase Users Leak Personal Data Through Misconfigured AI-Built Apps

Some applications built on Supabase are leaving sensitive personal data open to anyone on the internet, according to findings first reported by TechCrunch. The exposed records stem from projects that were shipped with weak or missing security settings, allowing outside parties to pull information that was never meant to be public. The problem is not a breach of Supabase itself so much as a pattern of customer misconfiguration.

Supabase sells itself as an open-source alternative to Google's Firebase, bundling a Postgres database with authentication, file storage, and auto-generated APIs. That convenience is the point: developers can wire a working backend into an app in minutes, often without writing server code. When access rules are left at their defaults or set too permissively, though, the same APIs that make the product easy to use can hand a stranger the keys to a table of user records.

The exposure lands in the middle of a broader shift in how software gets made. AI coding assistants and 'vibe coding' tools now let people with limited security training stand up full applications in an afternoon, and those apps frequently connect to hosted backends like Supabase. The result is a growing class of products that look finished but carry configuration mistakes a seasoned engineer would have caught before launch.

This is not the first time hosted backends have leaked at scale. Firebase faced similar publicity years ago when developers left its real-time database rules open, exposing everything from chat logs to health information. Supabase has published guidance on row-level security, the feature it expects customers to use to restrict who can read or write each row, but that guidance only helps if builders know to apply it.

For teams shipping with AI assistance, the practical fallout is a harder look at defaults. A database that is reachable from the browser and governed by rules a generator may have written is only as safe as those rules, and auditing them is now part of the release checklist rather than an afterthought. Expect more scrutiny of what these tools produce when nobody reviews the access layer.

What remains open is how much data was exposed and for how long, and whether Supabase will change its defaults or add stronger guardrails for less experienced builders. The company has not detailed any platform-wide fix, and the affected customers have not been named. Until defaults shift, the burden stays with the people clicking deploy.