Railway vs Supabase

Railway urges users to revoke keys after cyberattack

Developer platform Railway confirmed a cyberattack that allowed hackers to access and decrypt some customer secrets, including API keys and passwords. The company urged all users to revoke and rotate their credentials, as the breach may have compromised encrypted environment variables. The attack is likely part of a broader campaign targeting AI inference providers, with possible ties to AI distillation attacks. Railway paused builds during investigation but has since restored service. Affected user count and root cause are undisclosed. Railway plans to publish a post-mortem. The incident follows recent warnings from CISA about China-based AI companies conducting large-scale attacks on U.S. firms.

• Railway confirmed a cyberattack allowing hackers to access and decrypt some customer secrets.
• The company urged all users to revoke and rotate API and cloud keys.
• The attack may be part of a broader campaign targeting AI inference providers.

Introducing Railway Authentication via identity-aware proxy

Railway Authentication implements an identity aware proxy at the service or environment level to lock down sensitive http endpoints

AI Agent Frameworks Have a Critical Engineering Flaw

The author argues that the current enthusiasm for AI "agents" and hot frameworks distracts from the real engineering challenges of production systems. They define a true agent as a system with an objective that decides next actions, handles failure, and knows when it is done. In production, most agent deployments are narrow, purpose-built pipelines (e.g., support triage, document extraction, code review). Teams that succeed focus on tool design, failure handling, and observability rather than swapping models. The author highlights a persistent retrieval problem in RAG pipelines—incorrect chunking and metadata cause context loss and hallucinations—and recommends architectural patterns (plan-then-execute, separate retrieval from reasoning, explicit handoffs) and better data representations over framework chasing.

• Author defines an 'agent' as a system with an objective that decides what to do next, handles failure, and knows when it is done.
• Most production AI agent deployments are narrow and purpose-built (examples: customer support triage, document extraction, code review).
• Successful teams prioritize tool design, failure handling, and observability over only upgrading model versions.

Supabase is acquiring Turso

Supabase is acquiring Turso, a serverless SQLite database company, announced on October 2, 2026.

Supabase data exposure: 16,000 databases leaking personal data

Cybersecurity firm UpGuard has discovered that approximately 16,000 databases hosted by Supabase, a popular development platform for AI vibe-coded apps, are exposing sensitive personal data to the public web. The exposed data includes names, addresses, phone numbers, and passwords, some of which are linked to sensitive projects like an Indian adult streaming site, a U.S. valet service, an immigration service, and even an African consulate. While Supabase, which recently reached a $10 billion valuation, has made security improvements, its CISO Bil Harmer emphasized that security is a shared responsibility and that projects are 'secure by default'. The findings highlight the growing risk of data breaches due to misconfigured AI-generated applications, as the ease of building apps with AI tools often leads to security flaws.

• UpGuard found around 16,000 Supabase-hosted databases exposing personal data.
• Exposed data includes names, addresses, phone numbers, and passwords.
• Supabase reached a $10 billion valuation earlier in 2026.

Supabase is now available in Gemini Enterprise

Connect Supabase to Gemini Enterprise and query your Supabase projects with natural language, right inside the platform.