General Analysis Blog company blog
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
- Points
- 848
- HN comments
- 470
- Submissions
- 1
- Cited by
- 4 commenters
Security & PrivacyDatabases & Data2025
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Jul 8, 2025 | Supabase MCP can leak your entire SQL database by rexpository | 848 | 470 |
Cited in comments
Linked from 4 Hacker News comments by 4 different people, from Jul 2025 to Jul 2025.
Most recent:
- tomhow · Jul 9, 2025
- consumer451 · Jul 8, 2025
- rvz · Jul 8, 2025
- pvg · Jul 7, 2025
