Vibe Coding Applications Announced 16 Thousand Databases

16.326 database. All open to everyone, all have readable tables. According to the research published in UpGuard on September 25, 2026, Cybersecurity company has found personal data traces over half of these databases working on Supabase. The common point of leaks is that most of them have fast-established vibe coding applications with artificial intelligence coding tools. The findings of the report in this article address the steps that may be taken to protect the technical origin and projects of the problem.

What Has Supabase Data Leaked?

Research signed Greg Pollock, Director of UpGuard’s Research and Insight UpGuard’s report titled "Everything Everywhere" published. The team first used the technology detection data of BuiltWith and Google Chrome UX Report data set. Supabase switches and database addresses have been sought in JavaScript files that are open to everyone.

In the next step, access to a table called "users" named about 300 thousand domains. Three types of responses were received from databases: access refused, no "users table but the table is open" in the form of a tip or direct data. After all, the 16.326 database has been detected to offer readable tables.

A finding that pays attention to the report does not change the result of the operating model. The B2C or B2B service of the site has not created a difference in the type of distributed data. In geographic distribution, it was noted that the leaks are more common in developing areas, while better practices are seen thanks to the data protection laws of Europe.

Which Data Is On?

Besides personal information such as name, e-mail, birth date and address in open tables, PAN and Aadhaar records with passport, license and ID documents of India were seen. Passwords, API tokens and disposable verification (OTP) codes are included among leaking data. Stripe information on the payment side and the last four digits of the cards were found.

In the sectoral distribution, e-commerce and restaurants stand out due to payment systems with personal data. In terms of unlicensed betting sites password and identification information, industrial product vendors were ranked as risk groups in terms of corporate customer data. The cases that UpGuard shares as an example are concreted the size of the problem:

11% of the e-mails leaked in the Valet service was reported that 4.560 addresses belong to regional employers and Fortune 500 companies. In the case of consularity, the data appeared in emergency shelter positions.

What is Row Level Security And Why Is It Out Circuit?

Supabase is a platform that offers open source PostgreSQL database with ready authentication and API layer. The application connects directly to the front-face database with an open key to anyone called "anon". This key is normally accepted by design to appear in the browser. The security of the data is provided with Row Level Security (RLS), meaning line-level security policies. If RLS is not open, everyone who has anon switch eline can read the table.

The history of the problem is not new. Developer Matt Turner on March 2025, Lovable A common misconfigure on databases created with the platform reported, and the open CVE-2025-48757 code was lost. According to the news published in Cybernews In Lovable, there was also a separate error that reveals the source code, database credentials and artificial intelligence chat history.

Supabase then opened RLS in tables created with Table Editor on its interface. According to UpGuard, the main space remains here: RLS default on tables created as a programmatically via the API. Coding agents also work exactly this way with Supabase. It is also added that RLS is open in the report that it is not enough alone, policies should be properly established and used with correct credentials.

How to Grow Coding Agents Bulet?

Supabase in the UpGuard report is defined as the database product "Claude Code most recommended." Previous research focused on smaller examples from platforms such as Lovable and Replit. The new study is not a single vehicle, but the permission of a general image.

"The common point is that these sites are created by artificial intelligence coding agents and are not aware of the configuration of people. " (UpGuard report)

It is necessary to read correctly: the problem is that the agents are malicious or the code does not work. The app works, user registration is received, the payment is received. The remaining security configuration that no one looks. In the report, it is noted that people know what kind of work, but how the database is configured.

Vibe Codin g The approach allows non-software development to remove products with a few commands. The same speed also strengthens the perception of "exchanged" if it is running. Masqot previously discussed Agentjacking Attack showed how coding agents can be blood from outside. Supabase case shows doors that the agent can leave open only because of a missing adjustment without any attack.

Supabase, S3 And GitHub Coast: Does Story Again?

UpGuard compares Supabase with two platforms that pass a similar way earlier. In the report, data leaks are expressed from the palpitation of the user base size with the ease of misconfigure of a technology. The unsecured default settings in Amazon S3 led to thousands of leaks that still last, the GitHub’s "open to everyone as açık" model also reminds numerous credentials to disclose.

The response on the facade of Supabase was established on joint responsibility. According to the news published in TechCrunch The company’s information security director (CISO) Bil Harmer said:

"Security at Supabase is no time finished work. We care about doing this right. "

Harmer also added that security is a shared responsibility among customers with the company. As the user base of the platform, which reached 10 billion dollars in June 2026, the risk is also growing at the same rate according to the formula of UpGuard. In the closing of the report, S3 and GitHub are indicated that it is likely to drive these problems without a rooted change in default settings as it did over time.

How to Secure Vibe Coding Project?

If an application developed with artificial intelligence is using Supabase, the first control is that RLS is open in each table. According to Supabase's Advisors documentation The Security Advisor section on the panel lists RLS as alerts off tables. Closed tables can be protected by a single line SQL command:

alter table public.users enable row level security;

The first step to open RLS. If the policy is not written after the opening, the table is completely locked, a policy written to the arrival may still give everyone the permission to read. The main points to note are:

Anon and service role switch: The key to anion is considered normal to appear percent. The service role key with all authorizations should never be put into the browser, mobile app or an open warehouse to everyone.

Inspection of agent output: When the creation of tables from the coding agent is asked, the RLS policies should also write, and the description of which user can read what for each table.

Storage of sensitive data: Passwords are kept in plain text, not as hash. Files such as ID document should not be included in open storage areas.

Test: Before the application is released, it should be said that a user who has not been logged in can access the tables with anion switch.

The topic for initiatives from Turkey is not only a matter of technical adjustment. A application that processes personal data remains open, direct interest the obligations of the data controller under the Personal Data Protection Law No. 6698. According to the decision of the Personal Data Protection Board 2019/10 violations must be reported in the Board at the latest 72 hours. KVKK and AI In the written article, companies were discussed in detail what they should pay attention to in this process. Artificial intelligence code writing sites Home Quickly adding database access test to the pre-publish control list of teams that make the product fast, the cost of a possible breach remains as a small workload.

Frequently Asked Questions

Is Supabase hacked itself?

No, an attack was detected in the Supabase infrastructure. Leaks are caused by incorrect configuration of applications using the platform. Databases have access to their apps with open-standing switches in their JavaScript files.

What is Row Level Security (RLS)?

RLS is the security mechanism that determines who have the authority to read and write for each line in PostgreSQL. The protection of data is largely based on RLS policies, as it is connected directly to the pre-face database in Supabase. If RLS is closed, everyone who finds the open key to everyone can read the table.

Is it at risk of any application made with Vibegithub?

No, the risk is connected to the configuration not used. According to the finding of UpGuard, RLS in tables created via the API is higher than the possibility of skipping this step in the projects established with coding agents because it does not open default. A project written correctly in RLS open and policies is not affected by this.

How do I understand if my application is affected?

The fastest method to check Security Advisor alerts on the Supabase panel. Then without login, it can only be tested which data will return by querying tables with anon switch. If the data is spinning, RLS should be opened and written in the policy.

What to do when the open database is noticed?

Before opening RLS on corresponding tables, access should be closed, un leaked API switches and passwords should be renewed. If there is a leak that contains personal data, it is necessary to notify the Board within 72 hours in Turkey. Among the obligations to inform users affected.

Coding agents can remove an application from a few hours, but it doesn’t even ask if it locks the doors of the application. S3 and GitHub had years to change default settings. After this report, companies developed by Supabase and coding agent, it will also determine the number of new cases that will be revealed in the coming months.