2024 Supabase — RLS misconfiguration, thousands of instances
Data compromised
Full database access; user data; API keys; payment data
Technical writeup
Widespread: missing Row-Level Security leaves anon key as master key. Attackers dump databases via REST API. CVE-2025-48757 affected 170 Lovable apps. MCP data leak July 2025: AI agents with service_role keys bypass RLS.
Root cause
Opt-in RLS; default-insecure design; developer misconfiguration