My AI-built app leaked user data: the first 24 hours

Hours 0 to 2: stop the leak

1. Close what is open: turn on Row Level Security, make the storage bucket private, or take the endpoint offline.
2. Rotate every secret key that was in the browser or the repository: the Supabase secret or service_role key, Stripe, OpenAI, Anthropic and your email provider.
3. If sign-in was affected, sign everyone out and force password resets.

Hours 2 to 8: find out what was exposed

1. Export your database, API and hosting logs now. Some plans keep them for only a day or a week.
2. List which tables and files were open, for how long, and whether the logs show access from outside.
3. Write down what you find, with times. You will need it for any report.

Hours 8 to 24: decide who you must tell

• Users in the EU and the UK: report to the data protection authority within 72 hours of becoming aware, unless the breach is unlikely to put people at risk. Tell the people affected directly when the risk to them is high.
• Users in the US: every state has a breach notification law, with its own triggers and deadlines.
• Business customers: B2B contracts often require notice within a set time.

Talk to a lawyer before you send anything, and keep what you share to facts you have confirmed.

After the first day

Fix the cause, not only the symptom, then run the production checklist so the next problem doesn't come from somewhere else.