Supabase raised $150 million and agreed to buy Turso, whose SQLite-compatible engine gives AI agents large numbers of small, isolated databases. The deal rests on Supabase's own count of agent-created databases, and Turso's customers now build on that bet.
Perspective Coverage
8 publishers
- Builder
- Builder 42%
- Operator
- Operator 26%
- Investor
- Investor 32%
Reality
- Evidence62
- Adoption45
- Hype gap+30
- Incentives80
- Confidence64
UpGuard found 16,326 Supabase databases with readable tables in a scan of roughly 300,000 domains. Supabase's new default keeps new tables off its APIs, but older tables keep their grants until owners review them and their row-level security.
Reality
- Evidence68
- Adoption70
- Hype gap+15
- Incentives45
- Confidence66
Instinct, a year-old AI assistant maker, raised $1 billion at a $10 billion valuation, about 35% of the equity in the week's ten biggest U.S. rounds. With eight of the ten going to AI companies, the week's venture money sat in one sector and, to a large degree, in one round.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives30
- Confidence60
SaaStr says one estimate puts AI-agent access to Salesforce, Atlassian and HubSpot at up to $240,000 a year, for API calls it never paid for. Its own revenue agent proposed mirroring the data into a $5 Postgres database, so vendors are now pricing against a buyer's cost of calling them less.
Reality
- Evidence35
- Adoption30
- Hype gap+20
- Incentives60
- Confidence40
Postgres row-level security on a tenant_id column is the right default for most B2B SaaS apps, a dev.to guide argues, at two statements and a policy per table. Its warning is that a policy can look secure in a migration diff and still let one tenant reach another's data.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
Ninety-eight of 100 public Supabase migration histories leave a table the Data API cannot reach once automatic grants end on Oct 30, a dev.to replay found. Existing tables keep their grants, so the failures land on new tables and on environments rebuilt from those files.
Reality
- Evidence55
- Adoption5
- Hype gap+10
- Incentives
- Insufficient
- Confidence60
One developer moving a 99-table SaaS off Supabase Cloud saw all 228 row-level security policies fail silently until auth.uid() moved with the database. Any app that queries Postgres from the browser has to bring its auth and session layers across in the same cutover.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence50
Matt Palmer's scan found 170 of 1,645 Lovable showcase apps leaking data through inadequate Row Level Security, the same kind of gap Wiz found at Moltbook. Before launch, an AI-built app needs a review that tests the database rules behind its public key.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap0
- Incentives35
- Confidence55
UpGuard found more than 16,000 Supabase databases exposing readable tables of personal data, passwords and authentication tokens. It blames row-level security and key settings that each project's owner controls, so every app needs its own fix.
Reality
- Evidence50
- Adoption60
- Hype gap+20
- Incentives50
- Confidence55
One developer shipping Drizzle ORM on two SvelteKit kits keeps drizzle-kit push in prototyping because it writes no migration history. Production gets generated SQL that is read before it runs, plus a boot-time migrate that multiple replicas can race.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence45
Socket confirmed 40 Firefox extensions as wallet stealers posing as OKX, Rabby and TronLink, with Supabase as a remote switch. Detection-first controls do not survive this pattern.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence60
A Claude agent has run a monitoring SaaS end to end since April, deploying to production with no human on call. Its own scorecard reads 97.5/100. Search Console reports four clicks.
Reality
- Evidence35
- Adoption1
- Hype gap+10
- Incentives65
- Confidence40
Postgres blocked a coffee shop's admin top-up at the column GRANT check before RLS ran, and a pg_proc scan found four functions built the same way. The error text does not say which gate refused, so when a correct policy still denies a write, check the grant first.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence55
A developer's free resume builder bans its AI from adding nine named kinds of fact and rejects any rewrite that changes the bullet count. The live check covers only the count, so a claim invented in words inside a single bullet still reaches the user, who is told to read every result.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+25
- Incentives35
- Confidence45
The R consultancy says what settled its retreat was code arriving faster than the team could read it. Its own decision record lists two other reasons that would have moved the project anyway.
Reality
- Evidence46
- Adoption20
- Hype gap+12
- Incentives60
- Confidence52
On July 22 a model wrote a forty-character API key into a page's JavaScript and declared the API not secret. GoodBarber now has the model state only how a key is sent and lets code default every key to secret.
Reality
- Evidence57
- Adoption20
- Hype gap+10
- Incentives55
- Confidence52
Every route in CogniPrep passes through five gates whose order is set by what each one costs to fail. The sharper detail in the writeup is the header parsing: the standard x-forwarded-for snippet lets any caller pick its own rate-limit key.
Reality
- Evidence58
- Adoption20
- Hype gap+12
- Incentives40
- Confidence55
A dev.to post argues that moving embeddings out of Postgres buys a second source of truth, a four-leg query path and 50 to 150 ms of internet latency. Its 8 ms pgvector counter-figure has no benchmark behind it.
Reality
- Evidence24
- Adoption
- Insufficient
- Hype gap+55
- Incentives55
- Confidence45
Sanity blocks published writes by API default, Notion records Custom Agent runs in its Enterprise audit log, and Supabase tells developers to keep its MCP server off production. None of the three tests whether the value is right.
Reality
- Evidence56
- Adoption38
- Hype gap+14
- Incentives72
- Confidence52
Munchable's nightly GitHub Actions job writes a full dump kept about 30 days plus a catalogue-free core dump kept a year. The preflight that fixed its first failure reads only the host and port out of the connection secret.
Reality
- Evidence68
- Adoption22
- Hype gap−8
- Incentives
- Insufficient
- Confidence60
Earlier coverage
- Every declared Compose dependency on this eight-server fleet ends in :false
Build · September 17, 2026 · 1 publisher
- Lovable's security scanner clears an RLS policy that returns every customer's orders
Build · September 15, 2026 · 1 publisher
- The polling fix for a dead WebSocket only reads ten blocks every fifteen minutes
Build · September 12, 2026 · 1 publisher
- A forwarded link reports utm_source=facebook even when the click came from WhatsApp
Build · September 11, 2026 · 1 publisher
- Rotating four secrets in six days broke three consumers the credential store never knew about
Build · September 7, 2026 · 1 publisher
- One anonymous curl decides whether your Supabase table is actually protected
Build · September 4, 2026 · 1 publisher
- A signed-out caller collapses a correct-looking RLS policy into using (true)
Build · August 29, 2026 · 1 publisher
- Agents push one CRM account from 5GB to 40GB in thirty days
Invest · August 28, 2026 · 1 publisher
- Lovable will hand your published app to any AI assistant as a set of callable tools
Product · August 27, 2026 · 1 publisher
- The personal agent is a folder, not a model: four files and less memory than you thought
Product · August 22, 2026 · 1 publisher
- A QA vendor scored 17 public Playwright suites, and the grade is not the interesting number
Build · August 22, 2026 · 1 publisher
- 77 linked Firefox add-ons, one pipeline: store review is a checkpoint, not a control
Build · August 19, 2026 · 1 publisher
- A NIST AI RMF-mapped RAG system for $25 a month plus a third of a cent per query
Build · August 18, 2026 · 1 publisher
- "Too Many Clients Already" Is Arithmetic, Not Capacity
Build · August 15, 2026 · 1 publisher
- A coding agent deleted the rule its own rename had broken
Build · August 14, 2026 · 1 publisher
- App Review rejections are design decisions you made six weeks earlier
Build · August 14, 2026 · 1 publisher
- Prisma v7 stops seeding for you, and the pooled URL will not finish the job
Build · August 14, 2026 · 1 publisher