Supabase RLS Gaps Are the Real Cost of the $0 Indie Stack

The free stack has a catch, and it isn't the bill

The pitch for building software in 2026 is seductive. Pair an AI coding assistant with generous free tiers from Supabase, Vercel and Resend, add a boilerplate starter, and you can go from idea to deployed SaaS in a weekend 5. One indie toolkit guide claims AI tools such as Cursor and Claude Code cut development time by three to five times. It argues that the real bottleneck is choosing the wrong tools and over-engineering before anyone pays 5.

A growing body of security scanning suggests a different bottleneck. Configuration that nobody thought to write is quietly leaking user data. The cost of the "$0 stack" is turning up in exposed databases, not on invoices.

What the scans found

Securityscanner.dev says it examined more than 4,785 deployed apps built with AI tools and logged 669 critical vulnerabilities 1. Its headline figure is that 7% of apps built with Lovable and Bolt had databases anyone could read. A control group of YC-backed companies scored 0% 1. The firm notes that both groups share the same backend (Supabase), the same framework (React) and similar deployment pipelines. In its view, the gap comes down to what the developer knows and what the code generator assumes 1.

The examples are not abstract. One therapist coaching site built with Lovable reportedly exposed 15 tables. They included payment methods, upcoming session schedules, subscriber lists and email delivery logs for paying clients 1. A health booking app returned another patient's name, phone, email and appointment when a user simply changed a sequential ID in the API URL 1. The scanner also flags problems beyond Supabase's Row-Level Security (RLS). These include insecure direct object references, broken access control and APIs with no authentication at all 1.

Newly.app's breach checklist puts larger numbers on the same pattern. It cites a January 2026 SupaExplorer scan of more than 20,000 indie vibe-coded launch URLs. About 11% of them exposed Supabase credentials directly in frontend code 2. The most dangerous case is a leaked service-role key, which bypasses normal access rules entirely 2. The checklist also points to Wiz's February 2026 finding that Moltbook, a vibe-coded AI social network, exposed roughly 1.5 million API tokens through a Supabase database missing RLS 2. It adds GitGuardian's count of 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% jump 2.

The two security sources measure different things. One counts readable databases and the other counts exposed keys, so their percentages aren't directly comparable. They do point in the same direction: the database layer of AI-assembled apps is often left in its permissive default state.

Why RLS is the weak point

Supabase's model lets a frontend talk more or less directly to the database. That design depends on RLS policies to decide who can see which rows. If those policies are absent, a public key in the browser can become a skeleton key. My reading is that AI code generators are optimized to make features work, and an app with open tables works perfectly in a demo. Nothing fails visibly until someone outside goes looking.

That explains why the YC control group matters. The tooling is identical. What differs is whether someone on the team knows to ask the question the AI didn't 1.

The "$0" framing is shaky on cash, too

The stack isn't entirely free on the monetary side either. The indie guide lists starter API credits, such as $5 from Anthropic and OpenAI 5. Claude Code itself, though, is not included in Anthropic's free plan. Using it requires Pro, Max, Team, Enterprise or API credits 4. Pro costs $20 a month ($17 billed annually), and Max runs $100 or $200 34. Every paid tier also carries rolling five-hour session limits and weekly ceilings, which Anthropic has changed more than once this year 3. One pricing guide puts Pro at roughly 44,000 tokens per five-hour window for Claude Code 4. These costs are modest, but they show that "free" usually means "cheap until you rely on it."

The takeaway

The economics of solo building really have improved, and the speed gains are plausible. Still, the evidence suggests that the most expensive line item in a vibe-coded app is the security review that never happened. Builders shipping on Supabase should treat a few steps as part of launch:

• Enable and test RLS on every table.
• Keep service-role keys out of client bundles.
• Check whether incrementing an ID returns someone else's data.

An AI assistant can write those policies if asked. The problem the scans keep surfacing is that nobody asked.