UpGuard finds 16,000 Supabase databases leaking personal data online
Security research ties a wave of exposed names, addresses, phone numbers and passwords to misconfigured, often vibe-coded apps built on the database platform.
What to know
- UpGuard identified roughly 16,000 Supabase-hosted databases exposing personal data such as names, addresses, phone numbers, passwords and authentication tokens.
- Exposed data spanned sensitive contexts: sex worker conversations on an adult streaming site, valet license plates, immigration service contacts, a government consulate's records, and a SIM-farm phishing operation.
- The exposures are linked to misconfigured, often AI 'vibe-coded' apps, raising questions about whether easy app-building tools outpace developers' security awareness.
- Supabase, valued at $10 billion this year, says security is a shared responsibility and its defaults are secure, but has faced repeated scrutiny over customer misconfigurations.
“secure by default”
Bil Harmer, Supabase CISO · TechCrunch ↗ · Sep 24
UpGuard Cybersecurity research firmSupabase Database/backend development platformBil Harmer Chief Information Security Officer, Supabase
The record 2 articles and posts · last 30 days
- summary covers to here · Sep 26, 12:39 PM · 1 piece above arrived after
What people are saying 3 voices from 2 sites · verbatim
- Sep 27
-
D
Supabase customers are publicly exposing large amounts of user data because AI-generated and vibe-coded apps often lack proper… #Supabase #AIsecurity #DataPrivacy #AppSecurity
-
N
UpGuard found ~16,000 Supabase databases exposing personal data publicly — vibe-coded apps inheriting basic misconfigurations at scale. Audit your Row Level Security before shipping.
- Sep 25
-
D
UpGuard found around 16,000 Supabase databases exposing sensitive data, including names, phone numbers and passwords. The findings highlight growing security risks from AI-built apps and simple misconfigurations. https:// techcrunch.com/2026/09/25/some -supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web/