Thousands of Supabase databases are leaking personal data to the open web

Cybersecurity firm UpGuard told TechCrunch that it found around 16,000 databases hosted on Supabase where some degree of personal data was exposed to the open web. Supabase lets web and app developers store and run their databases on its platform.

Earlier this year Supabase reached a $10 billion valuation, driven largely by developers hosting their vibe-coded apps there. But the company has faced criticism over how it handles user security: there are widely documented cases of users misconfiguring or unknowingly exposing their databases to the wider internet, sometimes to the tune of millions of records each.

How AI code fuels the leaks

The findings underline how apps and sites built with AI can spill sensitive data through basic misconfigurations. AI tools make it easy to build a website or app, but the generated code often carries security flaws, and apps may require specific configuration the developer simply doesn't know about.

Over the years, countless breaches have been traced to improperly configured storage, databases and websites — leaking everything from military emails and visa applications to driver's license scans and children's data. Now the vibe-coding boom is fueling a new wave of breaches, increasingly linked to Supabase.

What was exposed

UpGuard found publicly accessible names, addresses, phone numbers and user passwords, along with a smaller number of passwords and authentication tokens. Affected projects included private conversations with sex workers on an Indian adult streaming site, thousands of license plates from a U.S. valet service, and contact details of people who used an immigration and relocation service. One database belonged to an African government's consulate in France; another was used by a virtual SIM farm to intercept one-time passcodes for text messages, typically to launch scams and phishing.

While most of the exposed datasets appear to be in the United States, UpGuard said this is a worldwide problem.

Supabase's response

Supabase Chief Information Security Officer Bil Harmer said the company had not yet seen the research but that its projects are "secure by default." He described security as a shared responsibility: "We provide secure defaults and tooling, and customers control how their own projects are configured," adding that the company notifies affected customers when issues are found. "Security at Supabase is never finished," he said.

UpGuard researcher Greg Pollock said the work matters for raising awareness about data exposures.

Source: TechCrunch