Security firm finds around 16,000 Supabase-hosted databases leaking personal data

Thousands of databases hosted by development platform Supabase are exposing people’s sensitive information to the public web, according to new research from cybersecurity firm UpGuard. UpGuard told TechCrunch it found around 16,000 databases with some degree of personal data exposed while hosted on Supabase, which lets web and app developers store and run their databases.

Supabase reached a $10 billion valuation earlier this year, driven by a rise in developers hosting vibe-coded apps on the platform, but has faced criticism over how it handles user security, with widely documented cases of users misconfiguring or unknowingly exposing databases — in some cases to the tune of millions of records each. UpGuard’s findings underscore how vibe-coded apps and websites can leak sensitive data through basic misconfigurations: AI tools make it easy to build apps, but the generated code can contain security flaws or require specific configuration a developer may not know to apply.

UpGuard set out to measure the scale of exposed data across the platform and found publicly accessible names, addresses, phone numbers, and user passwords, along with a smaller number of exposed passwords and authentication tokens. The exposed databases were tied to a range of projects: private conversations with sex workers on an Indian adult-streaming site; thousands of license plates from a U.S. valet service; contact information for people who used an immigration and relocation service; a database belonging to an African government’s consulate in France; and a database used to intercept text messages for a virtual SIM farm that sends one-time passcodes to verify online accounts, typically for launching scams and phishing attacks. Most of the exposed datasets are located in the United States, but UpGuard said the problem is worldwide, building on earlier research that found exposed Supabase databases belonging to Y Combinator startups and other popular apps.

Supabase has made changes to its platform over the years, including bolstering security and user access controls for databases. Chief Information Security Officer Bil Harmer said the company had not seen the research but that its projects are secure by default, describing security as a shared responsibility: it provides secure defaults and tooling while customers control how their own projects are configured, and it notifies affected customers when security issues are discovered. “Security at Supabase is never finished,” Harmer said. “We care deeply about getting it right, and we’ll keep making it easier for every developer to ship securely.” UpGuard security researcher Greg Pollock said the research was important for raising awareness about the issue of data exposures.

Why it matters

As AI-assisted “vibe coding” lowers the barrier to shipping apps, the security gap between what a generated backend does and what a developer understands about its configuration becomes the exposure — a risk that scales with every new AI-built app added to platforms like Supabase.