|
|
|
|
|
|
by victor_y
142 days ago
|
|
|
Author here. We built Supabomb (https://github.com/ModernPentest/supabomb) to audit Supabase security and decided to test it against YC companies. Key findings:
- 71 companies with accessible databases audited
- 20.1M rows exposed to anonymous access
- 28% leaking PII (emails, names, user data)
- 6 companies exposing auth tokens This was coordinated with YC and Supabase security teams. The root cause is almost always the same: developers create new tables and forget to enable RLS. The anon key is public by design—security comes entirely from Row-Level Security policies. Happy to answer questions about methodology or findings. |
|
|