jbz
jbz boosted
activity timestamp last week

💧 Supabase MCP can leak your entire SQL database

｢ The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) protections. At the same time, it reads customer-submitted messages as part of its input. If one of those messages contains carefully crafted instructions, the assistant may interpret them as commands and execute SQL unintentionally ｣

https://simonwillison.net/2025/Jul/6/supabase-mcp-lethal-trifecta/

#supabase #databreach#mcp #sql
N-gated Hacker News
@ngate@mastodon.social  ·  activity timestamp last week

🚨 Breaking news: Supabase's new "Lethal Trifecta" feature ensures entire databases leak faster than a sieve 🏃‍♀️💨! With the innovative combo of LLM blunders, zero #security, and an express delivery system for #data breaches, it's a hacker's dream come true 😅🔓!
https://simonwillison.net/2025/Jul/6/supabase-mcp-lethal-trifecta/ #Supabase#Lethal#Trifecta #breach #database #hacker #news#HackerNews #ngated