# Supabase customers leak thousands of databases

> Security research finds around 16,000 Supabase databases exposing sensitive personal data to the public web.
- Title: Supabase customers leak thousands of databases · TechCrunch
- Summary: Security research finds around 16,000 Supabase databases exposing sensitive personal data to the public web. Cybersecurity firm UpGuard found approximately…
- Keywords: supabase, data exposure, cybersecurity, upguard, ai-generated code, database security, misconfiguration, technology, startups, customers, leak, thousands
- Source: TechCrunch — https://techcrunch.com/2026/09/25/some-supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web
- Author: Zack Whittaker
- Published: 2026-09-25T17:29:46+00:00
- Read time: 1 min
- Topics: supabase, data exposure, cybersecurity, upguard, ai-generated code, database security, misconfiguration, technology, startups
## Thousands of Supabase databases exposed
Cybersecurity firm UpGuard found around 16,000 databases hosted by Supabase with some degree of personal data exposed to the public web.
## What data was exposed
UpGuard found publicly accessible names, addresses, phone numbers, and user passwords across the exposed databases, with fewer instances of authentication tokens.
## Real-world examples of exposed data
Exposed databases included private conversations from an Indian adult streaming site, thousands of license plates from a U.S. valet service, and contact information from an immigration and relocation service.
## Supabase's rapid growth and past issues
Supabase reached a ten billion dollar valuation earlier this year as developers hosted their AI-generated apps on the platform, but has faced criticism for how it handles user security.
## AI-generated code creates security risks
The findings highlight how AI-generated apps and websites can expose sensitive data through basic misconfigurations and improper security, as generated code often contains security flaws.
## Supabase says security is shared
Supabase's Chief Information Security Officer Bil Harmer said projects are secure by default and security is a shared responsibility. We provide secure defaults and tooling, and customers control how their own projects are configured.

> We provide secure defaults and tooling, and customers control how their own projects are configured.
## Harmer commits to ongoing improvements
Harmer said security at Supabase is never finished and the company cares deeply about getting it right, while continuing to make it easier for every developer to ship securely.

> Security at Supabase is never finished. We care deeply about getting it right, and we'll keep making it easier for every developer to ship securely.
## UpGuard highlights awareness need
UpGuard security researcher Greg Pollock said the company's research was important for raising awareness about the issue of data exposures on the platform.
## Key takeaway

Cybersecurity firm UpGuard found approximately 16,000 Supabase-hosted databases publicly exposing personal information, highlighting risks from misconfigured AI-generated code and improper security settings.