Supabase Data Exposure: What the New Research Found
Supabase data exposure is back in the spotlight after new security research revealed that thousands of databases hosted on the platform are publicly accessible, spilling sensitive personal information onto the open web. Cybersecurity firm UpGuard told TechCrunch it found around 16,000 databases where some degree of personal data was exposed while hosted on Supabase, a platform that lets web and app developers store and run their databases.
Supabase earlier this year reached a $10 billion valuation, driven by a surge in developers hosting their vibe-coded apps on the platform. But the company has faced criticism over how it handles user security. There are widely documented cases of users misconfiguring or unknowingly exposing their databases to the broader internet, in some instances to the tune of millions of records each.
The findings highlight how vibe-coded apps and websites can spill or expose sensitive data through basic misconfigurations and improper security. While AI tools make it easy to build websites and apps, the generated code can often contain security flaws, or apps might require specific configuration that the developer may be unaware of.
Why Supabase Data Exposure Keeps Happening
Over the years, countless data breaches have been linked to improperly configured storage servers, databases, and websites. Such cases have resulted in leaks of sensitive military emails, immigration and visa applications, classified government files, hundreds of thousands of driver’s license scans, and children’s personal information.
Now, the boom in AI vibe-coding is helping fuel a new wave of data breaches, many of which are now being linked to Supabase as more people use it for storing their data. UpGuard says it sought to understand the scale of exposed data across the platform and found publicly accessible names, addresses, phone numbers, and user passwords. The research surfaced a fewer number of passwords and authentication tokens.
What Data Was Found Exposed
The databases contained data linked to various projects, according to UpGuard. Those included:
Private conversations with sex workers on an Indian adult streaming site
Thousands of license plates belonging to a U.S. valet service
Contact information of people who used an immigration and relocation service
One of the databases belonged to an African government’s consulate in France, said UpGuard. Another was used to intercept text messages by a virtual SIM farm for sending one-time passcodes to verify online accounts, typically for launching scams and phishing attacks.
While the majority of these exposed datasets appear to be located in the United States, UpGuard said this is a worldwide problem. The findings build on earlier research that also found a range of exposed databases hosted on Supabase, including those belonging to Y Combinator startups and other popular apps.
How Supabase Responded to the Findings
Supabase has made changes to its platform over the years, including bolstering its platform and user access to databases.
When reached for comment, Supabase’s Chief Information Security Officer Bil Harmer said that while the company has not seen the research, its projects are “secure by default.” He described security as a shared responsibility between the company and its customers. “We provide secure defaults and tooling, and customers control how their own projects are configured,” and the company notifies affected customers when security issues are discovered, he said.
“Security at Supabase is never finished. We care deeply about getting it right, and we’ll keep making it easier for every developer to ship securely,” said Harmer.
UpGuard security researcher Greg Pollock said the company’s research was important for raising awareness about the issue of data exposures.
What This Means for Developers and Users
The scale of this Supabase data exposure should be a wake-up call for anyone building or using apps hosted on the platform. Misconfigurations remain one of the most common causes of data leaks, and AI-generated code can introduce security gaps that developers may not recognize.
For developers, the lesson is straightforward: review your database access rules, restrict public permissions, and never assume that default settings are safe for your specific use case. For users, the findings are a reminder that the apps and services you trust may not always handle your data as carefully as you expect.
Supabase’s “secure by default” stance places much of the responsibility on customers, but the sheer volume of exposed databases suggests that many developers are not equipped to manage these risks on their own.
The Bigger Picture for Vibe-Coded Apps
The rise of vibe-coding has lowered the barrier to entry for building software. That is largely a good thing, but it also means more people are shipping apps without a deep understanding of security best practices.
Supabase sits at the center of this trend because it offers an easy way to add a database and authentication to a project. When those projects go live with loose permissions, the consequences can be severe.
The Supabase data exposure research from UpGuard is not an isolated incident. It reflects a broader pattern of misconfigured databases and storage systems leaking data across the internet. Until secure configuration becomes the default experience for less experienced developers, these exposures are likely to continue.
For now, the best defense is awareness. Developers should audit their Supabase projects regularly, and users should think carefully about what data they hand over to apps built on the platform.
