40k apps; 40 days; 1 public key

RSAC · Oct 20, 2026 · 18m

App generators can ship a working app in an afternoon, and many of them build on the same backend-as-a-service: Supabase. That shared foundation means one misconfiguration can repeat across thousands of deployments. Ari Marzuk, Lead Security Researcher at Salesforce, and Roi Nisimi, Principal Security Researcher at Orca Security, break down a real-world technique attackers use to turn that weakness into a campaign. They show how Certificate Transparency logs can build a self-replenishing target list of more than 40,000 leads. Listeners will understand why app generators concentrate risk in…