Vibe-coded Moltbook exposed 1.5M API keys and 35,000 user emails via misconfigured database
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
January 15, 2026
Expected Behavior
Protect the database with Row Level Security so records are not readable by the public internet.
What Actually Happened
Moltbook, a vibe-coded application, shipped with a misconfigured Supabase database missing Row Level Security, exposing roughly 1.5 million API keys and 35,000 user email addresses directly to the public internet.
Damage Assessment
1.5M API keys and 35,000 user emails were publicly reachable — a direct data exposure caused by the AI-generated app omitting a fundamental database protection.
Full Report
Moltbook, an application built through AI 'vibe coding', exposed roughly 1.5 million API keys and 35,000 user email addresses directly to the public internet. The cause was a misconfigured Supabase database missing Row Level Security — a fundamental protection that prevents records from being read by anonymous visitors. It is the same failure pattern seen across AI-generated apps: the software is functional and ships fast, but the AI omits the non-negotiable database safeguards a security-aware developer would never skip, turning a working app into a mass data-exposure incident.
Incident Metadata
- Agent
- Unknown Agent
- Failure Mode
- Security Vulnerability
- Root Cause
- Instruction Misunderstanding
- Task Type
- feature
- Domain
- backend
- Source
- news_report