{"identifier":"continuum-ai-built-app-security-scan-2026-07-v1","name":"AI-Built App Database Exposure Scan, July 2026","alternateName":"Continuum 66-App Security Scan","description":"Aggregate results from a July 2026 observational scan of 66 live apps built with Lovable, Bolt, Cursor, base44, or Tempo, measuring Supabase adoption and anonymous table readability.","version":"1.0","datePublished":"2026-07-05","dateModified":"2026-08-06","temporalCoverage":"2026-07","collectionDatesLabel":"July 2026","creator":{"name":"Matthew Turley","url":"https://uxcontinuum.com/about"},"publisher":{"name":"Continuum","url":"https://uxcontinuum.com"},"builders":["Lovable","Bolt","Cursor","base44","Tempo"],"keywords":["AI-built apps","vibe coding security","Supabase","row-level security","anonymous database access","data exposure"],"observations":[{"id":"apps-screened","label":"Live AI-built apps screened","population":"All sampled apps","numerator":66,"denominator":66,"percentage":100,"displayPercentage":"100%","definition":"Live, reachable apps attributed to one of the five included AI-building tools."},{"id":"supabase-apps","label":"Apps using Supabase","population":"All sampled apps","numerator":32,"denominator":66,"percentage":48.4848,"displayPercentage":"48.5%","definition":"Apps whose public client bundle identified a Supabase project URL and public anon key."},{"id":"readable-table","label":"Supabase apps with at least one anonymously readable table","population":"Supabase-backed apps","numerator":13,"denominator":32,"percentage":40.625,"displayPercentage":"40.6%","definition":"At least one table returned a row to an unauthenticated GET request made with only the public anon key."},{"id":"sensitive-readable-table","label":"Supabase apps with at least one sensitive anonymously readable table","population":"Supabase-backed apps","numerator":5,"denominator":32,"percentage":15.625,"displayPercentage":"15.6%","definition":"At least one anonymously readable table contained a clearly non-public category such as user, subscription, private message, support, audit, employee, booking, or regulated-operation records."}],"url":"https://uxcontinuum.com/data/ai-built-app-security-scan-2026","methodologyUrl":"https://uxcontinuum.com/data/ai-built-app-security-scan-2026#methodology","sourceReportUrl":"https://uxcontinuum.com/blog/app-security/ai-built-apps-exposure-report","notes":["Only aggregate observations are published; app identities and row contents were not retained.","The readable-table and sensitive-readable-table percentages use the 32 Supabase-backed apps as their denominator, not all 66 screened apps.","Percentages are calculated from the published numerator and denominator. Headline copy rounds 40.625% to 41%."]}