Misconfigured Supabase apps expose data in over 16,000 databases

Over 16,000 Supabase databases were left exposed due to missing or improperly configured row-level security (RLS) policies, allowing unauthorized access to sensitive data including PII, passwords, and authentication tokens. The root cause lies in developers — particularly those leveraging AI-assisted development tools — deploying databases without fully understanding or implementing proper security configurations. This highlights a growing risk where the speed of AI-generated code outpaces security best practices, resulting in production systems that are functionally complete but dangerously exposed. The exposure of authentication tokens and credentials compounds the risk, as attackers can pivot from data theft to full account takeover. This incident underscores that cloud-native platforms still require deliberate security hardening regardless of how the application was built.