{"id":1250,"date":"2026-10-04T14:00:00","date_gmt":"2026-10-04T19:00:00","guid":{"rendered":"https:\/\/valhalla-computers.com\/?p=1250"},"modified":"2026-09-29T02:26:22","modified_gmt":"2026-09-29T07:26:22","slug":"vibe-coded-apps-supabase-rls-data-leaks-small-business","status":"publish","type":"post","link":"https:\/\/valhalla-computers.com\/index.php\/2026\/10\/04\/vibe-coded-apps-supabase-rls-data-leaks-small-business\/","title":{"rendered":"Vibe-Coded Apps Are Leaking Data: The Supabase RLS Lesson Every Small Business Builder Should Know"},"content":{"rendered":"

<\/p>\n\n\n

\"Vibe-Coded<\/figure>\n\n\n\n

Vibe coding has made it possible for a business owner to describe an app in ordinary language and have an AI assemble the database, interface, authentication, and logic in hours. That speed is extraordinary. It also creates a dangerous psychological shortcut: if the app works on the screen, people assume the plumbing behind it must be correct. New research from UpGuard is a brutal reminder that functional and secure are two different adjectives.<\/p>\n\n\n\n

What UpGuard Found<\/h2>\n\n\n\n

On September 25, security company UpGuard published research on <\/a>Sublease-backed applications<\/a>. Across roughly 300,000 identified domains, the researchers found 16,326 databases exposing readable tables<\/strong>. More than half of those exposed databases contained indicators of personal information, while smaller numbers included password or authentication-token fields and some appeared to involve payment-related data. The problem did not require a cinematic hack; in many cases, database access controls simply had not been configured correctly.<\/p>\n\n\n\n

The Important Detail Is How the Tables Were Created<\/h2>\n\n\n\n

Supabase uses PostgreSQL Row Level Security, usually shortened to RLS, to control which users can read or change which rows. UpGuard highlighted a dangerous difference between tables created through safer dashboard workflows and tables created programmatically through SQL, migrations, APIs, or coding tools. When an AI agent writes the schema, it may create a perfectly functional table without also enabling the policies needed to stop unauthorized reads. The app works beautifully right up until somebody asks the database a question it should never answer.<\/p>\n\n\n\n

This Is Not an Argument Against Supabase or AI Coding<\/h2>\n\n\n\n

Supabase is widely used because it makes powerful database and authentication features accessible, and AI coding tools are popular because they make software creation faster. The lesson is about shared responsibility. A platform can provide security controls while a developer\u2014or an agent acting like a developer\u2014configures them incorrectly. Every generated application should be reviewed as if it were written by a very fast junior programmer who confidently finished the assignment but may not know what it forgot.<\/p>\n\n\n\n

Small Businesses Have More to Lose Than They Think<\/h2>\n\n\n\n

A little scheduling app can contain names, phone numbers, addresses, notes, and appointment history. A quote form can contain property details. An internal dashboard can contain employee records. A membership app can contain payment identifiers and account information. The fact that the company only has five employees does not make leaked customer data harmless. Small organizations often have less legal, security, and public-relations capacity to recover when something goes wrong.<\/p>\n\n\n\n

Security Review Needs to Be Part of the Build Prompt<\/h2>\n\n\n\n

When using an AI builder, explicitly require authentication rules, authorization checks, Row Level Security where applicable, input validation, rate limiting, secure secret storage, dependency review, logging, backups, and tests for what an unauthenticated user can access. Then verify those controls independently rather than trusting the generated explanation. Ask the system to attack its own assumptions, but also use platform security advisors, code review, and outside testing for anything handling sensitive data.<\/p>\n\n\n\n

Do Not Store Secrets Where the Browser Can Read Them<\/h2>\n\n\n\n

One recurring mistake in AI-generated applications is putting privileged keys, service-role credentials, or private tokens into front-end code because doing so makes the first demo work. Anything delivered to the browser should be treated as public. Server-only secrets belong on the server, and database policies should assume attackers can see the public project URL and ordinary client credentials. Security that depends on nobody inspecting JavaScript is not security.<\/p>\n\n\n\n

Bottom Line<\/h2>\n\n\n\n

The most frightening part of UpGuard\u2019s 16,326 exposed databases is how ordinary the failure is. No zero-day exploit is required when an application simply forgets to lock the door. AI coding can be an incredible accelerator for small businesses, but speed does not transfer accountability to the model. Before a generated app stores real customer information, test what a stranger can read, what an ordinary user can change, and whether every table has the access rules you intended. \u201cIt works\u201d is the beginning of the review, not the end.<\/p>\n\n\n

<\/p>\n

\"Valhalla<\/a><\/div>\n

<\/p>","protected":false},"excerpt":{"rendered":"

UpGuard found more than 16,000 Supabase databases exposing readable tables. The problem is a warning for anyone using AI coding tools: a working app is not automatically a secure app.<\/p>\n","protected":false},"author":1,"featured_media":1273,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pgc_sgb_lightbox_settings":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4],"tags":[424,68,506,595,33,1085,14,571],"class_list":["post-1250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-small-business-websites","tag-ai-tools","tag-artificial-intelligence","tag-consumer-protection","tag-responsible-ai","tag-small-business-technology","tag-technical-seo","tag-valhalla-computers","tag-wordpress"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t