Vibe-Coded Apps on Supabase Are Leaking User Data at Scale
The Development
Multiple Supabase customers are publicly exposing sensitive user data due to misconfigured row-level security settings, with affected databases accessible to anyone on the open web. The pattern is directly tied to the rise of AI-generated and vibe-coded development — applications built rapidly using AI coding assistants like GitHub Copilot or Cursor, where developers move fast on functionality and skip or misunderstand security configuration. Supabase, a popular open-source backend-as-a-service platform, provides row-level security controls, but they require explicit activation. AI-generated code frequently skips this step because the models optimise for functional output, not hardened infrastructure. The exposures span personal identifiable information across what appear to be consumer-facing applications, raising immediate regulatory exposure for the businesses involved.
Our Take
The structural problem here is not Supabase — it's that AI-accelerated development has decoupled shipping velocity from security competence. Vibe-coding workflows hand functional, deployable applications to people who lack the operational knowledge to configure them safely. Marketing teams are directly in this risk zone: campaign microsites, lead capture apps, loyalty portals, and personalisation tools are exactly the class of lightweight applications being vibe-coded at scale. Any app touching first-party customer data that was built in the last eighteen months using an AI coding assistant should be treated as a security unknown until proven otherwise. GDPR Article 25 — privacy by design — makes the developer's intent irrelevant; the controller is liable regardless of how the code was generated.
What Changed
AI coding assistants can now generate full-stack applications fast enough that non-security-trained developers ship production databases to the web without understanding the access control layer. The capability is speed-to-deployment; the gap is that security configuration remains a human responsibility the tooling does not enforce.
Marketing Impact
Marketing operations and martech teams carrying AI-built or agency-delivered campaign tools that sit on Supabase or similar BaaS infrastructure face immediate liability risk. Any customer data passing through those tools — form submissions, CRM sync, behavioural data — is potentially exposed.
Competitive Implication
Brands with mature security review processes for martech deployments absorb this risk quietly. Brands that adopted vibe-coded development without governance guardrails now face regulatory exposure and customer trust damage that their more disciplined competitors avoid entirely.
Strategic Outlook
Regulatory bodies in the EU and UK are watching AI-generated code failures closely. A high-profile enforcement action against a brand for a vibe-coded data leak is a near-certainty within the next twelve months, and it will accelerate mandatory AI development audits across enterprise marketing stacks.
The Exploit
Action Item
CMOs with AI-built marketing tools in production should commission an immediate security audit of any Supabase-backed application handling customer data — prioritising anything deployed in the last eighteen months — before Q4 campaign traffic amplifies the exposure surface.