Cybersecurity firm UpGuard reported that it discovered roughly 16,000 databases hosted on Supabase where some degree of personal information was publicly accessible on the web. Supabase provides database hosting and runtime services for web and mobile application developers.
Supabase reached a $10 billion valuation earlier this year as more developers started hosting their apps and data on the platform. However, the company has faced criticism over how user security is managed: numerous documented incidents show users misconfiguring or inadvertently exposing their databases to the broader internet, in some cases affecting millions of records.
UpGuard's findings underscore how so‑called vibe‑coded apps and websites — often rapidly built with AI tools or scaffolding generators — can leak sensitive information through basic misconfigurations and insufficient security settings. While these tools simplify building sites and apps, generated code may contain security flaws and developers may lack knowledge of required configuration steps.
Over the years, many data breaches have been traced to improperly configured storage servers, databases and websites; past incidents have included leaks of sensitive military emails, immigration and visa applications, classified government files, hundreds of thousands of driver’s license scans, and children’s personal information.
In its survey, UpGuard said it found publicly accessible names, addresses, phone numbers and user passwords. It also located a smaller number of passwords and authentication tokens. The research highlighted concrete examples: private conversations with sex workers on an Indian adult streaming site; thousands of license plates from a U.S. valet service; and contact details of people who used an immigration and relocation service.
UpGuard additionally reported that one of the exposed databases belonged to an African government’s consulate in France, and another was connected to a virtual SIM farm used to intercept text messages and forward one‑time passcodes — tools commonly used to facilitate scams and phishing attacks.
Although most of the exposed datasets appear to be located in the United States, UpGuard emphasized that this is a worldwide issue. The new results build on earlier research that also identified a range of exposed databases on Supabase, including those belonging to Y Combinator startups and other popular apps.
Supabase has implemented changes to its platform over time, including measures to strengthen platform and user access controls. When contacted, Supabase Chief Information Security Officer Bil Harmer said the company had not yet seen UpGuard’s research but described Supabase projects as “secure by default.” Harmer framed security as a shared responsibility between the company and its customers: “We provide secure defaults and tooling, and customers control how their own projects are configured.” He added that the company notifies affected customers when security issues are discovered.
“Security at Supabase is never finished. We care deeply about getting it right, and we’ll keep making it easier for every developer to ship securely,” Harmer said.
UpGuard security researcher Greg Pollock said the firm’s research was important for raising awareness about the scale of data exposures on the platform.
