A TechCrunch investigation published this week found that a meaningful number of Supabase customers — many of them building AI-generated or "vibe-coded" applications — have left their databases publicly accessible, exposing user data to anyone with a browser and the right query. The findings are not a Supabase product failure. They are a process failure, and one with direct consequences for any Canadian organization that has moved fast to ship AI-assisted software.
What Actually Happened
Supabase is a popular open-source backend platform that developers use to store data, handle authentication, and build APIs. It's widely used by startups and AI app builders because it's fast to configure. The problem, as TechCrunch reported, is that some customers — particularly those using AI coding tools to generate applications quickly — never properly configured Row Level Security (RLS), the permission layer that controls who can read or write which data.
The result: databases with real user information sitting open to the public internet. Names, emails, usage data, and in some cases more sensitive records, fully readable without authentication.
Why Vibe Coding Is the Deeper Issue
This story is not really about Supabase. It is about what happens when AI tools lower the barrier to building software faster than organizational knowledge catches up.
Vibe coding — generating working applications through AI prompts rather than traditional software development — is genuinely useful. It lets small teams and non-technical founders ship products that would have required a full engineering team five years ago. That is a legitimate business advantage.
But AI code generators optimize for functionality, not security. They will produce an app that works. They will not reliably warn you that your database permissions are set to public by default, or that your API endpoints are unauthenticated, or that the schema you described in plain English exposes fields it shouldn't. That requires human review — ideally by someone who has shipped production software before.
The Canadian Compliance Dimension
For Canadian business leaders, this is not an abstract risk. PIPEDA requires organizations to protect personal information using security safeguards appropriate to the sensitivity of the data. Quebec's Law 25 — which came into full force in September 2023 — goes further, mandating privacy impact assessments, breach notification within 72 hours to the Commission d'accès à l'information, and carrying penalties of up to $25 million or 4% of worldwide turnover for serious violations.
Neither law cares how your application was built. An AI-generated app that leaks customer data is subject to the same scrutiny as one written by a senior engineering team. The organization is responsible.
For mid-market companies operating in regulated sectors — financial services, healthcare, professional services, retail with loyalty programs — the exposure is amplified. These are businesses that hold more sensitive data and face sector-specific obligations on top of baseline privacy law.
What to Do Before You Ship
If your organization has built or commissioned any AI-assisted applications in the past 18 months, a targeted security review is warranted. This does not require a full audit. Three specific steps reduce most of the risk:
1. Audit database permissions. If you are using Supabase, Firebase, or any backend-as-a-service platform, confirm that Row Level Security or equivalent access controls are enabled and tested. The default configuration on many platforms is permissive, not restrictive.
2. Review API authentication. Any endpoint that touches customer data should require authentication. AI-generated code frequently scaffolds open endpoints for development convenience and leaves them open in production.
3. Treat AI-generated code like any other vendor deliverable. Apply the same review process you would to code from an external agency or contractor. If you would not ship a contractor's work without a technical review, apply the same standard to AI output.
The Business Case for Slowing Down Slightly
Speed is the value proposition of AI-assisted development. That value is real. But one data breach — even a minor one requiring breach notification under Law 25 — can consume months of legal and operational capacity, damage customer trust, and invite regulatory scrutiny that lingers.
The companies that will build durable AI-assisted products are not the ones moving fastest. They are the ones moving fast with a functional review process on the back end. That is a process problem, not a technology problem, and it is entirely solvable.
If your team is shipping AI-built applications, now is the right time to establish that process — before a misconfigured database becomes the reason a regulator calls.
