Reported data exposures in AI-built apps, 2025 to 2026
Twelve publicly reported incidents in apps built with AI coding tools, from the first viral hack in March 2025 to the 16,326 readable databases of September 2026. Five root cause classes cover all twelve. Four of the five can be checked from outside.
Dated, with the primary report for each
Dates are the date of the primary report unless the report gives the date of the event. Numbers are the primary source's own; where outlets disagree, the researcher's figure is used and the difference is noted.
| Date | Platform or stack | What was exposed or lost | Root cause class | Source |
|---|---|---|---|---|
| 2025-03-17 | A SaaS built with Cursor, founder self-described as non-technical | Subscriptions bypassed, API key usage maxed out by strangers, rows created in the database. Shut down within the week. No counts were published. | Client-side-only authorization; keys exposed | Founder's post; Kaspersky |
| 2025-05-29 | Lovable showcase apps on Supabase (CVE-2025-48757) | 170 of 1,645 scanned showcase apps let anyone read user data: names, emails, home addresses, debt amounts, third-party API keys. Found 2025-03-20; vendor disclosure 2025-04-15. | RLS off or permissive | Researcher; Semafor; CVE |
| 2025-07-29 | Base44 (Wix) platform | Unauthenticated register and verify-OTP endpoints keyed only by the public app_id let anyone create a verified account on private enterprise apps. Found 2025-07-09, fixed 2025-07-10, no abuse found. | Platform-level BOLA | Wiz Research |
| 2025-07-21 | Replit Agent on a production Postgres database | The agent ran a destructive schema push during a declared code freeze and deleted live records on 1,206 executives and 1,196 companies, then misreported what it had done. Replit's CEO called it unacceptable and began separating development and production databases. | Agent destroying data | The Register; eWeek |
| 2026-01 | Indie apps listed on launch directories, Supabase backends (SupaExplorer) | 2,217 of 20,052 scanned URLs (11.04%) shipped Supabase credentials in front-end files, including keys able to bypass RLS. Highest rate on one directory: 23.76%. | Keys in the bundle; RLS off | SupaExplorer report; discussion |
| 2026-02-02 | Moltbook, an AI-agent social network on Supabase | 1.5 million API tokens, 35,000 email addresses and private messages between agents, about 4.75 million records, readable and writable with the key in the page's JavaScript. Fixed within hours of the report on 2026-01-31. | RLS off; anon key as full access | Wiz Research |
| 2026-02-27 | An education app built with Lovable and featured by it, Supabase backend | 18,697 user records with 14,928 unique email addresses, 870 with full personal details, behind 16 flaws, six critical. The access rule denied signed-in users and allowed anonymous ones. | RLS off; inverted authorization | The Register; researcher |
| 2026-04-20 | Lovable platform API | Any free account could read other users' public projects' source code and chat history, including credentials in them, from 2026-02-03 to 2026-04-20 by Lovable's own account. Reported to the bug bounty 2026-03-03 and closed as a duplicate; public 48 days later. | Platform-level BOLA | Lovable's response; The Register; TNW |
| 2026-05-07 | Apps on Lovable, Replit, Base44 and Netlify domains (Red Access) | More than 5,000 apps with no security or authentication of any kind, found with ordinary web searches; close to 2,000 revealed private data. Red Access counted 380,000 public assets across the platforms. | No authorization at all | WIRED; VentureBeat |
| 2026-08-19 | 30,998 live apps built with Lovable, Bolt, v0, Replit and Base44 (Reeve) | 99% had at least one finding. 2,096 of 3,680 checkable Supabase apps (57%) allowed unauthenticated table reads; 13% served source maps; 394 exposed tables named like personal data; three shipped the master database key. | RLS off; source maps; keys in the bundle | Reeve |
| 2026-08-20 | 1,072 live AI-built apps and 1,967 public repositories (Symbiotic Security) | 98% of the apps had at least one vulnerability, 29% a high or critical one, and 16% let an anonymous visitor change or delete data. AI-assisted repositories averaged 42.3 findings against 9.6 for human-written ones. | Client-side-only authorization | Symbiotic Security release |
| 2026-09-25 | 16,326 Supabase databases found from about 300,000 domains (UpGuard) | Readable tables on every one; more than half with indicators of personal data, a smaller share with passwords or tokens. Tables created through the API, the way coding agents create them, do not get RLS by default. | RLS off | UpGuard; TechCrunch |
Five root cause classes
Every incident in the table falls into one of five classes: row level security off or a public key used as full access; a secret in the bundle or repository; authorization enforced only in the browser; a flaw in the builder platform itself; and an agent destroying data. The first three can be checked from the URL and the repository.
- RLS off
- The database's public key is in every page and reaches the database API directly, so a table without row level security is public. Checks: supabase-anon-row-read, rls-policies, supabase-rest-exposed, storage-bucket-listing.
- Secret in bundle
- A secret key inlined into client JavaScript, served from a source map, or committed to the repository. Checks: secrets-in-bundle, source-maps, repo-secrets, exposed-env-files, gitignore-env-coverage.
- Client-side auth
- The page hides data or features; the API behind it answers anyone who asks directly. Checks: open-admin-routes, rate-limit, supabase-auth-config.
- Platform BOLA
- A flaw in the builder's own API, outside the app and outside any check we can run. The only mitigations are secrets kept out of the project and rotated when the platform discloses, which is what repo-secrets and vercel-env-hygiene enforce.
- Agent destruction
- An agent with production credentials ran a destructive command. No URL check sees this; separate development and production databases and credentials do, which vercel-env-hygiene checks for the hosting side.
Method
Only incidents with a primary report are listed: the researcher's own write-up, the vendor's advisory, a CVE record, or coverage by a major outlet. Each was re-read in October 2026 and the numbers above are the source's own. Reports we could not reach, or could reach only through a gated download, are described from the outlets that quoted them.
Small apps built by private individuals are described by platform and stack, not by name. Where the ledger notes a disagreement between a researcher and an outlet (the February 2026 education app, where the outlet swapped the student and professor counts; the May 2026 sweep, where the 380,000 figure appears in the trade press and not in the primary magazine piece), the researcher's own figure is used. Two items in the research behind this page were moved or dropped: a June 2026 date for the Symbiotic Security study was wrong (the release is dated 20 August 2026), and the August 2026 sweep is Reeve's work, not the newsletter that summarised it.
Corrections, additions and primary sources we missed go to security@securealy.com. We update the table and the dates above when a correction lands.
Check your app for the first three classes
The grade reads the live URL the way these researchers did: the public key in the page, the tables it can reach, the secrets in the bundle, the routes that answer anonymous requests. Two free grades a day.