Thousands of Supabase databases exposed

Cybersecurity firm UpGuard found around 16,000 databases hosted by Supabase with some degree of personal data exposed to the public web.

What data was exposed

UpGuard found publicly accessible names, addresses, phone numbers, and user passwords across the exposed databases, with fewer instances of authentication tokens.

Real-world examples of exposed data

Exposed databases included private conversations from an Indian adult streaming site, thousands of license plates from a U.S. valet service, and contact information from an immigration and relocation service.

Supabase's rapid growth and past issues

Supabase reached a ten billion dollar valuation earlier this year as developers hosted their AI-generated apps on the platform, but has faced criticism for how it handles user security.

AI-generated code creates security risks

The findings highlight how AI-generated apps and websites can expose sensitive data through basic misconfigurations and improper security, as generated code often contains security flaws.

Supabase says security is shared

Supabase's Chief Information Security Officer Bil Harmer said projects are secure by default and security is a shared responsibility. We provide secure defaults and tooling, and customers control how their own projects are configured.

“We provide secure defaults and tooling, and customers control how their own projects are configured.”

Harmer commits to ongoing improvements

Harmer said security at Supabase is never finished and the company cares deeply about getting it right, while continuing to make it easier for every developer to ship securely.

“Security at Supabase is never finished. We care deeply about getting it right, and we'll keep making it easier for every developer to ship securely.”

UpGuard highlights awareness need

UpGuard security researcher Greg Pollock said the company's research was important for raising awareness about the issue of data exposures on the platform.