Security Warning: Exposed Supabase API Keys Leave Databases Publicly Accessible
By
skilldeliver
5mo ago· 3 min readenInsight
75/100
Toasty
Bagelometer↗
Lightly toasted, lightly seasoned, mostly correct.
Score75TypeanalysisSentimentnegative
Summary
The article describes a security vulnerability where developers often leave their Supabase databases publicly accessible by exposing API keys in client-side code. The author demonstrates how they discovered a friend's SaaS project had an unprotected Supabase instance with an exposed anon key, allowing full access to database tables without authentication. The piece serves as a security warning about the dangers of improperly securing backend services and the common mistake of treating Supabase as a fully managed backend without implementing proper security measures.
Key quotes
· 3 pulledWhat makes it particularly easy is when they're using Supabase. It's so common from my side that every time I get access to a Supabase anon key just from inspecting the website and doing a simple curl request to check the tables everything is always unprotected and I get access to the
First simple step: inspecting, checking if there's something interesting. Voila, there is. A Supabase URL and anon key.
I was chatting with a close friend of mine and he sent me a link to his new SaaS that he's developing. Of course when a friend sends me their new project my natural tendency is to try hack it.
I was chatting with a close friend of mine and he sent me a link to his new SaaS that he's developing.
