Security firm UpGuard has found more than 16,000 misconfigured Supabase databases exposing readable tables that contain sensitive information, BleepingComputer reported Monday. More than half of the exposed databases held personal information, and some contained passwords and authentication tokens.

What Happened

UpGuard examined roughly 300,000 internet domains that showed signs of using Supabase, a popular open-source back-end platform built on PostgreSQL. In more than 16,000 cases, researchers could read database tables holding sensitive data. Beyond the personal information found in most of them, a subset stored passwords and auth tokens, and a small number appeared, based on their table structure, to hold payment card data.

The examples UpGuard gave, without naming the organizations, span several countries and sectors:

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts
  • A U.S. valet service exposed more than 100,000 customer records, including contact details, license plates and visit histories.
  • A Canadian immigration service exposed nearly 5,000 user records, among them 884 passwords stored in plaintext.
  • An India-based platform for adult content creators exposed identity information, payment account details and more than 100,000 private messages.
  • A Philippines-based one-time-password service exposed data on over 2,000 users and 100,000 SMS messages, including unrelated communications.
  • An African government consulate exposed records on 25,000 people, including addresses and emergency housing locations.

UpGuard said the causes were poor application security settings, chiefly missing or ineffective row-level security (RLS) policies and misuse of public keys. It notified owners where the exposure was significant.

Why It Matters

Supabase apps typically let the browser or mobile client talk to the database directly, using a public key that is meant to be embedded in the app. That design is only safe when row-level security policies restrict which rows each user can read or change. If RLS is switched off or written too loosely, anyone who extracts the public key from the app can query the tables, which is the pattern UpGuard describes.

The findings also put numbers on a concern about AI-assisted "vibe coding." According to BleepingComputer, AI-assisted development accounts for more than 60% of newly created Supabase databases. UpGuard did not attribute every exposure to AI tools, but researchers said many people building apps this way do not understand how their databases are configured. Tools that let non-specialists ship a working app in hours often produce a functioning product long before anyone has reviewed its access rules.

The Data at Risk

Several of the cases involve data that is hard to change once leaked. License plates and visit histories can reveal people's movements, plaintext passwords are likely reused on other services, and emergency housing locations held by a consulate could put vulnerable people in physical danger. SMS logs from a one-time-password provider may also contain login codes for unrelated accounts.

What to Watch

Owners of the flagged databases are expected to enable or fix RLS and rotate any exposed credentials. BleepingComputer pointed Supabase users to the platform's security advisors and API security guide. The research adds pressure on AI app builders and on Supabase itself to make secure configurations the default, rather than a step left to developers who may not know it exists.