GoKawiilUpGuard finds 16,000 Supabase databases exposing personal data publicly
Cybersecurity firm UpGuard identified roughly 16,000 Supabase-hosted databases that were publicly accessible, exposing personal information including names, addresses, phone numbers, passwords and some authentication tokens. Supabase, a backend platform valued at $10 billion this year, has seen surging use among developers building AI 'vibe-coded' apps, and has previously faced criticism over how customers configure database security.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings suggest that AI-assisted coding tools may be making it easier for developers to launch apps without fully understanding necessary security configurations, potentially amplifying the scale of data exposures. This pattern echoes past breaches tied to misconfigured cloud storage, and could increase scrutiny on platforms like Supabase to enforce safer defaults for less experienced developers.
- UpGuard found about 16,000 Supabase databases publicly exposing personal data.
- Exposed data included names, addresses, phone numbers, passwords and some auth tokens.
- The exposures are linked to a rise in AI 'vibe-coded' apps built on Supabase, which reached a $10 billion valuation this year.
Source: techcrunch.com — Zack Whittaker, 2026-09-25
Published there as: “Some Supabase customers are publicly exposing reams of people’s data to the web”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.