The Moltbook breach: what a public Supabase key without RLS grants
An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's…
Aliteq
Sam Ortega · Build Editor
The short answer
Moltbook, a viral social network for AI agents, was built on a Supabase database whose tables had no Row Level Security. Its public (publishable) Supabase key sat in the website's JavaScript, which…
What leaked: 1.5M agent API tokens, 35,000 emails, 4,060 private conversations (Wiz)
Why: a publishable Supabase key + no Row Level Security
How long to fix: about three hours from report to final fix (Wiz's timeline)
Your takeaway: turn RLS on for every table before anyone else sees your app
Aliteq
Read the full story
The Moltbook breach: what a public Supabase key without RLS grants