If you’ve shipped an app on Supabase, especially one you built quickly with AI coding tools, check your database settings today. New research from cybersecurity firm UpGuard found about 16,000 Supabase-hosted databases exposing some degree of personal data to the public web, according to TechCrunch AI. The exposed records include names, addresses, phone numbers and user passwords.
This isn’t a hack of Supabase itself. It’s thousands of customers leaving their data open to anyone who knows where to look.
🚨 What UpGuard Found
UpGuard told TechCrunch it set out to measure how much data is exposed across the platform. What it found reads like a list of worst cases:
- Private conversations with sex workers on an Indian adult streaming site
- Thousands of license plates from a U.S. valet service
- Contact details of people who used an immigration and relocation service
- A database belonging to an African government’s consulate in France
- A virtual SIM farm that intercepted one-time passcodes, typically used to verify accounts for scams and phishing
Passwords and authentication tokens showed up less often, but they were there. Most of the exposed datasets appear to sit in the United States, but UpGuard says the problem is global.
Why Supabase, and Why Now
Supabase lets web and app developers store and run their databases, and it’s become a go-to backend for vibe-coded apps. That popularity helped push the company to a $10 billion valuation earlier this year.
The catch is who’s using it. Vibe coding means describing an app to an AI tool and letting it write most of the code. That lets people ship products fast, but plenty of them don’t know which settings keep data private. As TechCrunch AI notes, AI-generated code can contain security flaws, and apps often need specific configuration that the developer may not even know exists.
This finding also isn’t new. Earlier research found exposed Supabase databases belonging to Y Combinator startups and other popular apps. There are well-documented cases of single misconfigured databases leaking millions of records each.
An Old Problem Moving Faster
Misconfigured storage has been behind data breaches for years. Past cases have leaked sensitive military emails, visa applications, classified government files, driver’s license scans and children’s personal information.
What stands out now is the speed. AI tools have cut the time from idea to live app down to hours. Security review hasn’t sped up to match. When anyone can launch an app that collects user data over a weekend, the number of badly protected databases grows with it. UpGuard’s 16,000 count shows the scale of that gap.
Supabase’s Response
Supabase CISO Bil Harmer said the company hadn’t seen the research, but that its projects are “secure by default.” He called security a shared responsibility.
“We provide secure defaults and tooling, and customers control how their own projects are configured,” Harmer said. He added that Supabase notifies affected customers when it finds security issues, and that “Security at Supabase is never finished.”
That’s technically fair. Supabase has tightened its platform and database access controls over the years. But secure defaults don’t help much when the people building apps don’t understand what they’re turning off.
🛡️ What to Do If You Build on Supabase
Most of these leaks come down to access rules that are off or too loose. In Supabase, the key feature is Row Level Security (RLS): database rules that decide which rows each user can read or change. The public key built into your frontend is meant to be seen by anyone, so if RLS is off on a table, that key can often read the whole table. Here’s a quick checklist:
- Turn on RLS for every table that holds user data, and write policies that limit access to the right users.
- Never put your service role key in client code. It skips every access rule.
- Test your app like an outsider. Try to query your tables with only the public key and see what comes back.
- Don’t store plain-text passwords. Use Supabase’s built-in auth instead of rolling your own user tables.
- Read Supabase’s security warnings in your project dashboard and fix what they flag.
- Ask your AI coding tool to audit its own work, then check the results yourself. Don’t assume generated code is safe.
What Comes Next
UpGuard researcher Greg Pollock said the goal of the research was to raise awareness about data exposures. Expect more reports like this one. As vibe-coded apps keep multiplying, researchers and attackers alike will keep scanning for open databases. Platforms like Supabase will likely face pressure to make risky settings harder to switch on and easier to spot. Until then, protecting user data falls to the person who shipped the app.
The full report, with more detail on UpGuard’s findings, is at TechCrunch AI.