How Codex found replayable state transitions and a lost-update race in a Supabase browser game

Large-scale security audit of 1,764 "vibe-coded" apps: 7% have wide-open Supabase DBs, 15% of Bolt apps ship hardcoded API keys, plus IDOR and zero-auth APIs

Another exposed Supabase DB strikes: 20k+ attendees and FULL write access