Vibe-coded apps built on Supabase found publicly exposing user data
2026-09-25
TechCrunch reported that some Supabase customers are publicly exposing large amounts of user data to the web, with the findings highlighting how AI-generated and 'vibe-coded' apps can spill and expose users' data when not configured or secured properly.
Significance 3: A concrete, named example of AI-code-generation tooling producing insecure production deployments is a direct operational-lane adoption-failure instance, though the report doesn't quantify how many apps or users are affected.
Implications · machine-drafted, not owner judgment
A clean, named instance of the technology illusion: AI-assisted code generation produces a working app, but the accountability for securing the backend doesn't travel with the generated code, and nobody ends up owning it. This is the accountability gap the book targets in the presales/GTM context, now showing up in a more diffuse form among individual 'vibe coder' builders rather than enterprise IT.
- Whether Supabase ships stricter default security settings in response
- Whether other AI code-generation platforms (Replit, Lovable) report similar exposure patterns
Sources
- press Some Supabase customers are publicly exposing reams of people's data to the web retrieved 2026-09-26