News at a Glance
The findings highlight how AI-generated and vibe-coded apps can spill and expose users' data when not configured or secured properly.
What Happened
On September 25, 2026, TechCrunch published an investigative report revealing that multiple Supabase user projects had publicly exposed database tables containing personally identifiable information (PII), including names, email addresses, phone numbers, and some payment records. The investigation found that these projects were largely AI-assisted or vibe-coded, with developers failing to configure row-level security (RLS) policies or enable access controls. Supabase, an open-source Firebase alternative offering PostgreSQL databases, authentication, and real-time subscriptions, defaults to allowing anonymous access but requires developers to explicitly enable RLS. In the
Background
Since its launch in 2020, Supabase has attracted numerous startups with its PostgreSQL compatibility and free tier. The vibe-coding ecosystem—generating applications from natural language descriptions—exploded between 2025 and 2026, with related GitHub projects growing 300% year-over-year. However, AI-generated code often lacks security context, producing unprotected database endpoints by default. Previously, Firebase faced similar data leaks due to configuration errors, but Supabase's RLS mechanism relies more heavily on manual developer activation, inc
Deep Dive
From a technical perspective, Liu Gong believes the core issue is not a Supabase platform vulnerability but a systemic blind spot in AI-generated code regarding security configuration. AI training data contains minimal security configuration examples, causing generated code to skip RLS by default. Liu Gong compares traditional development: developers read documentation and manually enable RLS, while AI-generated code treats this step as optional. Liu Gong predicts that without improving security annotations in AI training data, such issues will grow exponentially with vibe-coding adoption. From a business perspective, Liu Gong notes that Supabase's business model relies on developer trust, and while this incident is not directly the platform's fault, it could erode its reputation as an enterprise-grade backend. Liu Gong cites data: Supabase raised $120 million in Series B in 2025, valued at $1.2 billion, with 70% of customers being early-stage startups. If these teams face lawsuits due to data leaks, platform retention will suffer directly. Liu Gong recommends Supabase introduce mandatory RLS-enabled configuration templates and automated security scanning tools to restore market confidence.
Data Points
- Comparison 1: Supabase defaults to anonymous access while Firebase requires authentication by default, leading to a significant misconfiguration rate gap—RLS-related questions account for 30% of Supabase community forum posts versus 8% for Firebase. Comparison 2: Only 12% of AI-generated code includes RLS configuration, compared to 67% for human-written code. Comparison 3: Affected projects exposed an average of 23,000 records, with the largest single case reaching 87,
- Comparison 4: Vibe-coding project count grew 300% year-over-year in 2025, but secu
Impact & Outlook
For the industry, in the short term (3 months), Supabase will face a user trust crisis, with new paid subscriber growth expected to slow by 15-20%. In the medium term (1 year), low-code platforms may collectively introduce default security configurations and automated audit features, forming new industry standards. For ordinary users, in the short term, caution is advised when using vibe-coded startup applications and submitting sensitive information; in the medium term, risks will gradually decrease as platforms improve security, but users should develo
Angles to Explore
Points to consider
- Who bears security responsibility for AI-generated code: developers or platforms?
- The contradiction between rapid vibe-coding ecosystem expansion and lagging security governance
- How open-source database platforms balance ease of use with security
Source & Original
This item comes from TechCrunch AI (published 2026-09-25 17:29:46). Wenfeng Radar provides a Chinese/English summary and commentary on overseas AI developments; the original content is owned by its author.
Further reading: 2026 Frontier LLM Comparison: A Practical Guide — a durable, evergreen reference. Bookmark it.
Daily aggregation of overseas AI developments with in-depth analysis. Bookmark us to never miss an important signal; back to homepage.