A public key met an open data boundary

What happened

Wiz described missing row-level security in the deployment it examined. Its timeline records successive access fixes on 31 January and 1 February 2026.

Why it matters

Supabase distinguishes publishable keys from secret keys. A publishable key belongs in client applications; what it can reach depends on role grants and row-level policies. Treating every client key as a secret misses the boundary that actually needs examining.

What was affected

The Moltbook deployment Wiz examined, through its reported Supabase access-policy configuration. No Supabase product-wide version range was assigned. This was a reported deployment misconfiguration, not a claim that all Supabase projects were vulnerable.

What to examine

1. Inventory the exposed schemas and tables, then review effective role grants and row-level policies together.
2. Use synthetic accounts in an authorized test project to test permitted and denied reads and writes. A read restriction that works does not establish write isolation.
3. Where credential exposure is confirmed, follow the owner’s incident process to revoke or rotate the affected credentials and check the services that depend on them.

Evidence to keep

• Timestamped snapshots of grants and policies, labeled as source files or as observed from the deployment
• Synthetic-account read and write test results
• A credential-remediation record where exposure is confirmed

Scope and limits

The source does not establish malicious exploitation or Moltbook’s current configuration. PRAE has not reproduced the research. Wiz reported remediation complete on 1 February 2026.

Control mappings: NS-SHIP-01, NS-AUT-02, NS-DB-02, NS-SEC-05. Mappings organize the lesson. They do not establish that any application meets those controls.

Sources

1. Wiz research account. Wiz. The deployment finding and reported remediation timeline. Reviewed 2026-10-29.
2. Supabase API-key guidance. Supabase. Publishable and secret key distinctions. Reviewed 2026-10-29.
3. Supabase row-level security guidance. Supabase. Role grants, policies and access testing. Reviewed 2026-10-29.