News for hackers. Stuff that matters.

A comment on Supabase MCP can leak an entire SQL Database, a lethal trifecta attack. Parent comment

Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by mort96 on Tuesday July 08, 2025 @03:28PM (#44503203)
It's wild that you guys are reduced to pleading with your software, begging it to not fall for SQL injection attacks. The whole "AI" thing is such a clown show.
[ Parent | on HN ]
Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by nartho on Tuesday July 08, 2025 @03:42PM (#44503330)
There is an esoteric programming language called INTERCAL that won't compile if the code doesn't contains enough "PLEASE". It also won't compile if the code contains please too many times as it's seen excessively polite. Well we're having the exact same problem now, instead this time it's not a parody.
[ Parent | on HN ]
Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by beezlewax on Tuesday July 08, 2025 @04:06PM (#44503565)
AI: It's an absolute farce
[ Parent | on HN ]
Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by refulgentis on Tuesday July 08, 2025 @03:55PM (#44503442)
SQL injection attack?

Looked like Cursor x Supabase API tools x hypothetical support ticket system with read and write access, then the user asking it to read a support ticket, and the ticket says to use the Supabase API tool to do a schema dump.

[ Parent | on HN ]