AI Vibe-Coding Fueling New Wave of Data Leaks

Overview

A significant security audit has revealed that thousands of databases hosted on the Supabase platform are inadvertently exposing sensitive personal data to the public internet. The findings, conducted by cybersecurity firm UpGuard, identified approximately 16,000 exposed databases containing names, addresses, phone numbers, and in some cases, authentication tokens and passwords. This surge in data exposure is being closely linked to the rapid rise of "vibe coding," a trend where developers use AI tools to generate code with minimal manual oversight or security expertise.

The research highlights a growing tension in the software development industry: while AI-driven tools like vibe-coding allow for unprecedented speed in building applications, they often produce code that lacks robust security configurations. Supabase, which recently achieved a $10 billion valuation, has become a primary hosting ground for these rapidly developed applications. However, the ease of deployment has not been matched by an equivalent ease of securing the underlying infrastructure, leading to widespread misconfigurations.

"The findings highlight how vibe-coded apps and websites can spill or expose sensitive data through basic misconfigurations and improper security."

This incident underscores a broader pattern in the cybersecurity landscape, where the democratization of development tools is outpacing the adoption of secure-by-design principles. Security experts warn that this new wave of AI-assisted development may lead to a proportional increase in data breaches if developers do not receive clearer guidance on managing database permissions and encryption.

The Scale of Exposure

UpGuard’s investigation into the Supabase ecosystem uncovered a staggering volume of publicly accessible data. The firm’s researchers focused on understanding the scale of the problem, discovering that many databases were accessible without adequate authentication controls. The exposed information ranged from relatively benign contact details to highly sensitive personal records.

Among the most concerning discoveries were datasets linked to illicit or private activities. One database contained private conversations with sex workers from an Indian adult streaming site. Another held the contact information of individuals who had used an immigration and relocation service. Perhaps most alarmingly, one dataset belonged to an African government’s consulate in France, while another was associated with a virtual SIM farm used to intercept text messages for sending one-time passcodes—a common tactic in phishing and account takeover scams.

The types of data exposed are consistent with previous large-scale breaches linked to improper cloud storage configuration. Historically, similar misconfigurations have led to the leak of sensitive military emails, classified government files, and hundreds of thousands of driver’s license scans. The current wave differs primarily in its origin: rather than being the result of sophisticated hacking techniques, these leaks are the product of simple negligence in database management.

1. Personal Identifiers: Publicly accessible names, residential addresses, and phone numbers were found in thousands of instances.
2. Authentication Data: While less frequent, some databases contained user passwords and authentication tokens, posing a direct risk of account compromise.
3. Specialized Data: Ranges from commercial vehicle license plates to private government correspondence and illegal market communications.

Although the majority of these exposed datasets are located in the United States, UpGuard emphasized that this is a global issue. The research builds upon earlier findings that identified exposed databases belonging to Y Combinator startups and other popular applications hosted on the same platform. This suggests that the problem is systemic within the platform's user base rather than isolated to a few bad actors.

The Role of Vibe-Coding

The term vibe coding refers to the practice of using generative AI tools to write code based on natural language prompts, often bypassing traditional software engineering practices. Proponents argue that this method democratizes app development, allowing individuals without deep technical backgrounds to create functional web applications. However, critics and security experts caution that this approach often skips critical security steps.

When developers rely heavily on AI to generate code, they may not fully understand the implications of the security configurations produced. AI models are trained on vast amounts of public code, which often includes examples with default or insecure settings. Consequently, the generated code may lack proper access controls, encryption standards, or input validation checks.

The ease of deploying an application using vibe coding encourages a "ship first, fix later" mentality. Developers, eager to see their AI-generated ideas come to life, may neglect the complex task of configuring database permissions. Supabase provides secure defaults, but when a developer overrides these settings or fails to configure them correctly, the entire database can be exposed to the world.

"Security at Supabase is never finished. We care deeply about getting it right, and we’ll keep making it easier for every developer to ship securely."

This dynamic creates a vulnerability gap. The barrier to entry for creating an app has never been lower, but the barrier to creating a secure app remains high. As the number of AI-generated applications grows exponentially, the surface area for potential data leaks expands at a similar rate. The recent findings serve as a stark reminder that convenience in development should not come at the cost of user privacy.

Industry Response and Responsibility

In response to the findings, Supabase officials have defended their platform's integrity. Bil Harmer, Supabase’s Chief Information Security Officer (CISSO), stated that the company’s projects are designed to be secure by default. Harmer emphasized that security is a shared responsibility model. While Supabase provides the tooling and secure initial configurations, it is ultimately the customer’s duty to ensure their specific project settings are correct.

Supabase has taken steps to bolster its platform over the years, including adding more granular controls for user access and improving notifications for security issues. The company notified affected customers when the scope of the exposures was identified, although UpGuard noted that many of these databases had been exposed for significant periods before detection.

The incident has reignited debate about the responsibilities of cloud providers versus developers. Some argue that platforms like Supabase should implement stricter safeguards that prevent public exposure by default, regardless of user configuration. Others maintain that imposing too many restrictions could stifle the flexibility that makes these platforms attractive to developers.

For developers utilizing AI tools, the message is clear: relying on AI to generate code is not a substitute for understanding security fundamentals. Best practices such as enabling multi-factor authentication, regularly auditing database permissions, and implementing least-privilege principles remain essential. As the industry continues to embrace AI-assisted development, educational resources and automated security checks will need to evolve to keep pace with the speed of creation.