Software · 27 September 2026 · 4 min read
The True Cost of Vibe Coding: Over 16,000 Supabase Databases Exposed Online
In brief: A cybersecurity investigation conducted by UpGuard revealed that approximately 16,000 databases hosted on Supabase are exposing personal and sensitive user data to the public web. Rather than an infrastructure zero-day, the exposure stems from the surge of «vibe coding»: applications written entirely by generative AI models for novice builders, which routinely omit Row-Level Security policies or leak high-privilege keys straight into client-side code.
by Team Mocchi's
The widespread enthusiasm for «vibe coding» — building entire software products simply by describing requirements to an LLM without mastering backend fundamentals — has run headfirst into cybersecurity reality. According to a new investigation by security firm UpGuard, reported by TechCrunch, roughly 16,000 databases hosted on cloud platform Supabase are currently exposing sensitive personal records, credentials, and internal data to anyone with an internet connection.
Supabase, a PostgreSQL-powered Backend-as-a-Service platform that reached a $10 billion valuation earlier in 2026 on the back of the AI coding boom, sits at the epicenter of this exposure wave. Crucially, the issue is not a flaw in Supabase’s core infrastructure, but rather a direct outcome of applications engineered without architectural comprehension.
The Disconnect Between Prompts and Access Control
The root cause illustrates the structural shortcomings of unvetted machine-generated code. Supabase exposes database tables via instant auto-generated REST APIs, relying on PostgreSQL's Row-Level Security (RLS) to enforce access permissions. When RLS is disabled or misconfigured, anyone armed with a public project URL and an anonymous client key can query table endpoints directly and dump full database contents.
Because language models are optimized to provide code that runs without friction, they frequently resolve permission errors by loosening access rules, granting blanket public read access, or embedding the administrative service_role key directly into client-side repositories.
Creators relying purely on conversational prompting often accept these suggestions because the browser interface immediately begins working, unaware that they have completely dismantled database authentication for every visitor.
From Quick Prototypes to Severe Data Leaks
UpGuard’s findings show that the exposed instances contain sensitive records including personal identity documents, user directories, transaction histories, and private customer communications. These are not merely throwaway weekend hackathon scripts; many belong to commercial startups actively charging subscribers.
The findings spotlight a growing divergence across the industry: while generative models have eliminated the barrier to producing interactive interfaces, they have done nothing to lower the rigorous demands of data governance, infrastructure hardening, and compliance. Accelerating the deployment of unreviewed software simply magnifies an organization's attack surface faster than defensive teams can audit it.
Mocchi's take
This incident reinforces what we witness daily across digital projects: artificial intelligence is an extraordinary accelerator for teams with deep software architecture foundations, but it quickly turns into a operational liability when treated as a substitute for engineering discipline. For organizations navigating strict compliance regimes like GDPR, relying on automated prompting without strict human code reviews and automated security posture audits is an unsustainable risk. The competitive edge in software development does not come from generating code as fast as possible, but from building resilient architectures where speed never compromises data isolation and long-term security.