How do you know which websites are affected without sampling data from each website in question? As the blog explains, it's safe to serve public data from Supabase in this manner, so the only way to determine whether the website has an issue is to look at the actual records they are serving. Their approach seems entirely reasonable to me.

As someone who has dealt with vulnerability reports on products before, I'd strongly prefer getting concrete proof of an issue versus "your product came back as positive on our vulnerability scanner^tm" which is 99% of the time going to be a scam or a waste of time.