GoKawiilUpGuard finds 16,000+ misconfigured Supabase databases leaking user data
Cyber risk firm UpGuard scanned around 300,000 domains using Supabase and found more than 16,000 databases with misconfigured access controls exposing readable tables. Over half contained personally identifiable information, with smaller subsets exposing plaintext passwords, authentication tokens, and in some cases credit card data. Specific examples cited include a US valet service exposing 100,000+ customer records, a Canadian immigration service leaking 884 plaintext passwords, and an African government consulate exposing 25,000 records.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings suggest that Supabase's popularity with AI-assisted app development—accounting for over 60% of new databases on the platform, per UpGuard—may be outpacing developers' understanding of its access-control settings. This could indicate a broader pattern where fast, AI-generated backend deployments skip security review steps, leaving sensitive personal and financial data exposed at scale across many unrelated services.
- UpGuard identified over 16,000 misconfigured Supabase databases with publicly readable tables.
- Exposed data includes PII, plaintext passwords, authentication tokens, and some credit card details.
- AI-assisted development, which drives over 60% of new Supabase databases, may be contributing to configuration oversights.
YubiKey 5C NFC Security Key — With thousands of misconfigured databases leaking passwords and auth tokens, it's a good reminder to harden your own accounts against credential theft. A YubiKey adds hardware-based two-factor authentication so even if your password leaks in a breach like this, attackers still can't get in.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-28
Published there as: “Misconfigured Supabase apps expose data in over 16,000 databases”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.