my friend @MaxHirsch13 got hacked last night and all 35k user profiles on Maxed AI were deleted here’s what happened / how i helped fix it / how to prevent it: someone sent around 3,500 delete requests to his app and managed to wipe almost every user profile the first thing we focused on was getting everyone's data back, thankfully max was on Supabase Pro and had daily backups enabled, so we were able to recover the accounts but the real question was how someone managed to delete all those profiles in the first place after looking into the database permissions, we found the issue max had created a database view that allowed users to see each other's profiles, but that view was bypassing RLS (Row Level Security), which is supposed to control what data each user can access on top of that, the public anon role still had permissions that allowed deletion through the view basically, something that was supposed to let users VIEW other profiles accidentally gave the public a way to DELETE them and since Supabase's anon key is public by design, the attacker didn't need access to some private admin key to abuse it here's what i'd recommend checking in ur own app so this doesn't happen to u: 1. check ur RLS policies make sure every exposed table has RLS enabled and that users can only access or modify data they're actually allowed to, especially when it comes to DELETE and UPDATE operations 2. check every database view this was the main issue in max's case, make sure views use security_invoker = true where supported so they respect the underlying permissions, and check that public users can't write or delete through views they should only be reading 3. check ur API and database permissions just because someone is logged in doesn't mean they should be able to access everything, make sure every sensitive endpoint verifies the user and checks ownership before reading, editing, or deleting anything also check what the anon role can actually do in Supabase, a public API key should never give someone permission to delete private user data 4. check what happens when something gets deleted look for ON DELETE CASCADE rules because deleting one record can automatically delete other connected records also review privileged database functions and make sure users can't abuse them to bypass permissions 5. protect ur authentication and secrets make sure users can't change their own admin roles or subscription status, verify webhook signatures, remove any temporary authentication bypasses, and never expose private API keys in ur frontend 6. add protection against mass deletion limit dangerous operations where possible, keep logs of important actions, set up alerts for unusual activity, and make sure u have working backups even if someone finds a vulnerability, u don't want one request or a few thousand automated requests to permanently destroy ur entire database 7. actually test ur security create two test accounts and check whether one can access, edit, or delete the other's private data run Supabase Security Advisor and check the issues it reports and don't assume ur app is secure just because everything works normally tbh the scary part about this whole situation is that it wasn't some crazy complicated vulnerability, it came down to database permissions that were easy to overlook one mistake was enough to put 35k profiles at risk i've worked on security audits for different SaaS companies and one thing i've learned is that some of the most dangerous vulnerabilities come from the simplest mistakes so please spend some time checking ur app's security, especially if you're using AI agents to build most of ur code it takes way less time to check these things now than to recover an entire database after someone deletes it

Thanks @elonmusk 🙏

this is why I’m gonna continue posting forever tbh ❤️

wallahi im gonna make 1M before 20