Advisory VV-002critical2026-08
Supabase tables readable by anyone with no login
A scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.
What it is
A self-reported r/vibecoding scan (August 2026) ran nine external checks on 30,998 live apps built with Lovable, Bolt, v0, Replit and Base44. Of Supabase-backed apps where the check got an answer, 2,096 of 3,680 (57%) served rows to an unauthenticated request; in 394 the readable table was users, profiles or orders.
Escape’s 2025 report on vibe-coded apps likewise found a significant portion of issues in Supabase-backed apps stemmed from misconfigured or missing RLS.
How to check
- List every table and confirm RLS is enabled (SQL below).
- Look for policies using USING (true) on sensitive tables: that is effectively public.
How to fix
- Enable RLS everywhere, then replace permissive policies with ones scoped to auth.uid().
- Keep truly public content (e.g. blog posts) in separate tables from user data.
-- Tables in "public" with RLS turned off
select relname as table_name
from pg_class c join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;
-- Policies that allow everything
select tablename, policyname, qual
from pg_policies
where schemaname = 'public' and qual = 'true';