Some Supabase customers are publicly exposing reams of people’s data to the web

There's a familiar rhythm to these stories, and it's worth naming it: the platform is fine, the users are the problem, and the data is already out there. But what makes this Supabase situation genuinely different from the parade of misconfigured AWS S3 buckets that defined the last decade is the *how* of the exposure. We're not talking about a tired sysadmin who forgot to flip a toggle. We're talking about a new class of developer—or perhaps more accurately, a new class of *non-developer*—who assembled an application with AI assistance, never once touching the underlying infrastructure. The "vibe coding" phenomenon has been celebrated as a democratization of software creation, and in many ways, that celebration is warranted. But every abstraction layer that makes deployment easier also makes the failure modes less visible. Supabase's Postgres-based platform is genuinely powerful, and its row-level security (RLS) policies are a robust feature when enabled. The problem is that an AI code generator has no incentive to turn on RLS unless explicitly prompted, and a vibe-coder who's never heard of RLS isn't going to prompt for it. The result is a database that's open to the world by default, and a developer who doesn't even know what they don't know. This is the uncomfortable truth about the AI-assisted development boom: we've built a generation of tools that optimize for *shipping* while quietly deprioritizing *securing*. The incentives are misaligned. AI models are trained on patterns of code that often skip security best practices because those practices are verbose, unglamorous, and—crucially—not what the training data emphasizes. When the model produces a Supabase client that reads "SELECT * FROM users" without a WHERE clause scoped to the authenticated user, it's not being malicious. It's being statistically average. The deeper issue here is one of accountability. When a human developer ships a misconfigured database, there's a clear line of responsibility. When an AI-assisted developer ships the same misconfiguration, the blame gets diffused across the model, the platform, and the developer—and in that diffusion, nothing gets fixed. Supabase can add more prominent security warnings, and it should. But the real fix requires a cultural shift in how we teach and validate AI-generated code, treating security not as an afterthought but as a first-class output of the generation process itself. Source: [TechCrunch](https://techcrunch.com/2026/09/25/some-supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web/)