Short answer
Security research firm UpGuard found that thousands of databases hosted on the development platform Supabase were publicly exposing personal data such as names, addresses, phone numbers and passwords. The problem stems from security settings being skipped when apps are built quickly with AI-assisted vibe coding, a broad warning that developers should review their database access rules.
Highlights
- Cybersecurity firm UpGuard found some personal data publicly exposed across 16,000 databases hosted on Supabase.
- The exposed data includes names, addresses, phone numbers and some passwords; Supabase reached a $10 billion valuation this year.
- The root cause is mostly security configuration skipped in apps built quickly with AI-assisted vibe coding.
3 min read
Thousands of databases hosted on the developer platform Supabase are publicly exposing users' personal data to the web. As reported by TechCrunch, research by cybersecurity firm UpGuard found that some personal data had been exposed across 16,000 databases hosted on Supabase.
What exactly did UpGuard find?
Supabase, which web and mobile app developers use to host their databases, reached a $10 billion valuation this year, driven in large part by the rapid growth of apps built on the platform through AI-powered vibe coding. The data UpGuard found includes publicly accessible names, addresses, phone numbers and, in some cases, passwords and authentication tokens. Among the examples the researchers cited were private messages from an adult content platform, vehicle licence plate records from a valet service, client details from an immigration consultancy, a database belonging to an African country's consulate in France, and records from a virtual SIM farm used to intercept one-time password (OTP) verifications.
What is at the root of the problem?
Most of the leaks stem not from a new vulnerability but from developers failing to configure database access settings correctly. Generating code quickly with AI tools makes app development easier, but it also shows that the generated code can contain security flaws or require special configuration the developer is unaware of. According to TechCrunch, most of the findings are US-based, but the problem is global.
What does Supabase say?
The company's Chief Information Security Officer, Bil Harmer, said they had not yet seen the research but that its projects are designed to be 'secure by default'. Harmer described security as a responsibility shared between the company and its customers: Supabase provides secure defaults and tools, while customers decide how their projects are configured. The company added that it notifies affected customers when a security issue is identified.
Step-by-step checklist for securing your database
- Enable Row Level Security on every table; if it is off by default, the data stays publicly accessible.
- Test that the 'anon' key used on the client side can only reach the tables and columns you allow; a broadly privileged key is on its own the biggest source of risk.
- List every table in the public schema and review which ones genuinely need to be exposed; move those that do not into a private schema.
- Always review by hand the database schema and access rules generated by AI tools before going live; the generated code may appear to work yet still skip a security setting.
- In projects that may previously have been publicly exposed, rotate passwords, API keys and authentication tokens; simply closing off access does not recover data that has already been copied.
Frequently asked
- Is using Supabase inherently insecure?
- No. Supabase offers secure default settings; the problem usually arises when developers change those settings or skip enabling Row Level Security. Configured correctly, the platform can be used securely.
Sources
Follow UNIT Journal
What's new in search, AI and technology, in your feed every day.
