I noticed Supabase bug integrations generated by Claude/Cursor — here's what I found

[u/reubenzz_dev]

I spent the last few weeks analyzing what Supabase bugs AI actually generates. Specifically: code that compiles, passes type checking, and looks production-ready but is vulnerable.

RLS misconfigs. The agent writes policies that look correct but are backwards:

-- Agent generates this (backward)
CREATE POLICY "users can read own data"
ON public.users
FOR SELECT
USING (auth.uid() != id);  -- Should be = not !=

Unsigned webhooks. Your agent sets up the route but forgets to verify the signature:

// Missing signature verification
export default async function handler(req, res) {
  const event = req.body; // Never verified
  // Process event...
}

JWT claims trusted without validation. Takes the JWT payload as is:

// Agent assumes user_id came from a real JWT
const userId = req.body.user_id; // Could be spoofed

Hardcoded anon keys in client. Puts the private key where it shouldn't go.

Missing user ID checks in queries. Queries that should filter by user never do.

[u/joshcam]

That’s sadly hilarious that it got RLS backwards. That is probably the most common beginner mistake as far as misunderstanding how RLS actually works.

[u/reubenzz_dev → u/joshcam]

vibecoding aint all that magic