GoKawiil
Tech News
Supabase announced it is acquiring Turso, a company that rebuilt SQLite in Rust and built a cloud platform letting a single server manage millions of lightweight databases. Supabase said existing users on either platform won't see immediate changes: it will keep building on Postgres while Turso continues its SQLite work, with the two eventually integrated into one ecosystem.
Cyber risk firm UpGuard scanned around 300,000 domains using Supabase and found more than 16,000 databases with misconfigured access controls exposing readable tables. Over half contained personally identifiable information, with smaller subsets exposing plaintext passwords, authentication tokens, and in some cases credit card data. Specific examples cited include a US valet service exposing 100,000+ customer records, a Canadian immigration service leaking 884 plaintext passwords, and an African government consulate exposing 25,000 records.
Cybersecurity firm UpGuard identified roughly 16,000 Supabase-hosted databases that were publicly accessible, exposing personal information including names, addresses, phone numbers, passwords and some authentication tokens. Supabase, a backend platform valued at $10 billion this year, has seen surging use among developers building AI 'vibe-coded' apps, and has previously faced criticism over how customers configure database security.
KaribuKit, a hotel booking system built by the operator of Mara Hilltop lodge, discovered that a misconfigured 'pgbouncer=true' setting in Prisma's Supabase connection had forced every database query to make four network round-trips instead of one since March. Fixing the setting cut the availability check on the booking page from 8.06 seconds to 1.88 seconds. The discovery came the same night the team also fixed an unrelated crash caused by an image preloader overwhelming memory on mobile Safari.