xyborg

I have been playing around iOS apps now, I found many with exposed Firebase instances as well :/

Thanks, Paul, for the comment. It means a lot to me.

I also published a recap of what Supabase has been doing over the last year to improve all of this: https://supaexplorer.com/dev-notes/supabase-security-2025-wh... I now think it makes sense to include it in the top notice I added to my report, next to where it says "Supabase is NOT insecure by design," since key revocation was one of those changes.

I believe we all know, at least the ones who care about this topic, that you've been making a lot of improvements and adding extra annoying (but justified!) UI features to make this issue more prominent and push people to fix it.

"- contractually requiring Vibe coding platforms to expose our Security Advisors if they are integrating with us" - I like this, and I honestly would love to see those platforms truly enforce it, even when the user is just building an MVP not ready for production, which most of the time ends up there.

And definitely, any improvement in authz will be very helpful, especially if it can be pushed via external coding platforms.

Yes, sometimes is hard, and also kinda frustrating when they don't seem to care about their users' data privacy.

For Android/iOS, I know those are even worse, but it's tricky to get the data, might be easier to get and decompile the APKs though.

The vast majority of the web apps in those launch directories were built using some sort of AI tool, also there are certain fingerprints you can use to confirm some tools, like Lovable, V0, etc.

Yes, both statements are true, I am building a business around this, but I do also want to reduce the amount of insecure Supabase applications, and that's why I open sourced, and it's also free, my Chrome Extension. Because that's a quick check, any non-technical person can do.

I am currently in communication with many of the sources I used to harvest those sites, so they can warn them, and I also offered a quick API integration that can plugged in during their submission process, so they can warn users right before they launch their apps on those directories. Another option is to get their contact information, but there is no way I can get into their inboxes without being labeled as SPAM :/

Also, another thing I offer for free on my site, is the possibility of running an automated audit on your project, you just connect to Supabase using oAuth. And get a report of what's missing, from there you can either click the "fix in Cursor" or copy results button, and ask your favourite LLM to fix it, or buy my advanced report with the fixes for 5 bucks. But I do offer a free options though.

About this: "- LLM generated code: benchmark and evals to measure which popular programmatic LLMs recommend the right approach.", check this out https://cset.georgetown.edu/wp-content/uploads/CSET-Cybersec...

And, when it comes to community recommendations, I am doing my best, reaching out to dev influencers, posting regularly on /r/Supabase/ (not spamming, providing real value).

Last but not least, Supabase did added a LOT of new features in their dashboard to warn and prevent users from shipping tools unprotected, but the issue is many of these apps were created using CLI, GUI, or Web tools where the user almost never go to Supabase's dashboard, so they never see those warnings :(

Something remarkable happened in 2024-2025: building a full-stack app became easy. Tools like Supabase, combined with AI coding assistants and no-code builders, let solo founders ship production apps in days, not months.

But speed comes at a cost. As we started using SupaExplorer to audit projects, we noticed a pattern: many apps were misconfiguring their Supabase setup. The anon key in client-side code is fine; it's designed to be public. But we found apps exposing the service_role key (which bypasses RLS), or using the anon key with tables that had no RLS policies at all.

We decided to quantify the problem. Over the past month, we collected launch URLs from five major indie product directories and systematically scanned each one.

- 20,052 URLs Scanned - 2,217 Domains Exposed - 11.04% Exposure Rate - 2,325 Critical Exposures

What's Being Leaked

Not all exposures are equal. Finding a Supabase project URL and anon key in client code is expected, as both are designed to be public. The anon key provides low-privilege access that respects your Row Level Security policies.

The danger is when apps expose the service_role key (or the new sb_secret_... format), the elevated-privilege key meant only for server-side use. Of the 2,960 files flagged, we found credentials that could bypass RLS in a significant portion. We also verified which exposed databases had tables without RLS protection.

I would love to hear your thoughts on this, and how can we generating awareness about this topic.

The FAQ section is fixed now.

I focused on puppies, but elderly dogs is a nice use case though. Thanks for the input!

This is a nice use case though, helping with communication.

I probably wont continue doing it for long as well. I thought about this out of the necessity of tracking my puppy potty training. And it's not that we forget about going for a walk, is more like getting an idea of at what time of the day, on which frequency they need to pee or poop, and arrange the walks around those times so they can learn to do it outside quickly. So, this might be useful for puppy and also elder dog owners.

Thanks! I will check that out. It's possible to share your dog with other people, when you add a dog, the app generates a unique ID with a three-word-format you can share with other people so they can add the dog to their profile. I thought about this for sharing internally in the family, or for when you want your pet sitter to keep tracking your dog activities. And as the owner, you can revoke their access anytime.

The PDF/report is a great idea. I will give it a look on how other apps handle this to get some inspiration :D

I need to find some time to put some screenshots together, and record a quick video explaining how it works, and maybe split it so I can use it in the guide.

Noted! Google sign in is on my pending list now, it would also be very helpful for reducing fake/spam accounts for sure.

Ah, thanks for highlighting this! I must have messed up during the design fix I did last week :S

That's the same kind of question I had with other apps, and why I decided to build one myself. I will keep the current features free forever, and add more advance stats, alerts, maybe AI suggestions based on past activities, but those will be on a pro plan for sure. I am also working on a data exporting feature (it's listed in the features section as "soon"), because the data belongs to each dog owner, so it would be fair to let you export it whenever you want. When it come to monetization, there are several ways one can do it, without getting rid of the free tier.

Excellent question, I changed the icon to a dog face one, it's the "emergency card" quick access. I need to improve my UI/UX skills... :/ When you touch or click that icon, it will show you a card with all the information you might need to have at hand about your dog (owner info, allergies, medications, vet contact, etc.) You need to add this info into your dog's profile first. I will try to add a new section with more screenshots and update some of them.

I included some here: https://waulog.com/guide But I will add a new section with more detailed screenshots.

I created this service along with a friend to help people take the most out of their social profiles bio link. We believe we have a solid product, but are always looking for feedback :D

Great tip for travelers, I will suggest you to do this everytime.