170 Apps Exposed Because of This Tiny Database Setting
If you build with Next.js + Supabase, this is the stuff that actually gets apps hacked — not exotic zero-days, just a switch nobody turned on.
Database security is often ignored, leaving apps wide open to simple exploits. See how easily attackers access private user data.
Many developers build functional apps that look professional but neglect basic database security protocols. This video breaks down how a misconfigured database can allow anyone on the internet to pull emails, settings, and password reset tokens in seconds using just one line of code. If you are building or managing an application, understanding these risks is the first step toward better data protection.
We look at the reality of app security and why leaving a database exposed is a critical failure. You will learn the specific, simple ways attackers gain access so you can identify if your own systems are vulnerable. By reviewing these common oversights, you can better protect user data and ensure your backend is actually secure.
Subscribe for weekly cyber security breakdowns, and comment below if you have questions about securing your own database.
Database security is often ignored until it is too late. Learn how easily accessible data leaks happen and how to protect your app.
Many apps look professional to users while having critical database security flaws. This video explores the reality of open databases where unauthorized access allows anyone to pull emails, passwords, and user settings with just one line of code. If you are building software or managing user data, understanding these app vulnerabilities is essential to preventing catastrophic breaches.
We examine why developers sometimes leave doors wide open and the immediate risks involved when data protection is overlooked.
Based on this GuardLayer blog post:
👉 https://www.guardlayer.io/blog/ai-age...
Scan your own repo for free (no signup, no card):
👉 https://www.guardlayer.io/scan
━━ KEY TAKEAWAYS ━━
A Supabase table with Row Level Security (RLS) turned off is readable and writable by anyone holding the public anon key, which ships in every website's code by design.
AI coding agents leave RLS off because enabling it without a matching policy makes a feature return no data in the demo, which looks like the feature broke.
With RLS off, a table is a fully open API — anyone can read, edit, or delete its rows, not just read them.
CVE-2025-48757 (rated CVSS 9.3, Critical) involved AI-built apps shipping without proper RLS; researcher Matt Palmer found 303 exposed endpoints across 170 production apps leaking emails, payment status, and some API keys.
You can check for the problem in 30 seconds: count how many tables your migrations create versus how many times they enable RLS — if the first number is higher, some tables are unprotected.
A policy written as "using (true)" is not a fix — it re-opens the table to everyone while looking secure.
The real fix is to enable RLS and add a policy scoping access to the right user, e.g. only rows where the logged-in user's ID matches.
━━ COMMON QUESTIONS ━━
Q: What is Row Level Security (RLS)?
A: It's a per-row permission check on a database table that decides who is allowed to read or write each row. With it off, there is no check, so anyone can access everything.
Q: Isn't the Supabase anon key a secret that protects my data?
A: No. The anon key is public by design and ships in your website's code. RLS is the protection layer, not the key.
Q: Why do AI coding tools leave RLS off?
A: They optimize for a working demo. Turning RLS on without a policy makes queries return nothing, which looks like a regression, so the safe-seeming move for the model is to leave it off.
Q: Does turning RLS on break my app?
A: It changes "anyone can read this table" to "only the right user can." If a query returns empty afterward, that's the signal you need to add a policy, not disable RLS again.
Q: How do I check if my tables are exposed right now?
A: In your database, list the public tables that do not have row security enabled. Anything returned is reachable by anonymous users this second.
━━ SOURCES ━━
CVE-2025-48757 — NVD: https://nvd.nist.gov/vuln/detail/CVE-...
Matt Palmer's disclosure writeup: https://mattpalmer.io/posts/2025/05/C...
OWASP Agentic AI Top 10: https://genai.owasp.org/resource/agen...
Simon Willison, "The lethal trifecta": https://simonwillison.net/2025/Jun/16...
—
CHAPTERS
00:00 The app that's secretly wide open
00:40 You built it in 20 minutes (and felt like a wizard)
01:20 The one thing your AI skipped: RLS
02:20 Why the AI leaves security OFF on purpose
03:20 How bad is it actually? (one command, all your data)
04:30 This already happened — 170 apps, rated 9.3/10
05:30 The "fix" that makes it worse
06:20 The 30-second check you can run right now
07:00 The actual fix (it's not scary)
07:40 How to catch this automatically
—