Supabase - GoKawiil

UpGuard finds 16,000 Supabase databases exposing personal data publicly

Cybersecurity firm UpGuard identified roughly 16,000 Supabase-hosted databases that were publicly accessible, exposing personal information including names, addresses, phone numbers, passwords and some authentication tokens. Supabase, a backend platform valued at $10 billion this year, has seen surging use among developers building AI 'vibe-coded' apps, and has previously faced criticism over how customers configure database security.

techcrunch.com · 2026-09-25

Prisma pgbouncer setting quadrupled query round-trips on Supabase for six months, KaribuKit finds

KaribuKit, a hotel booking system built by the operator of Mara Hilltop lodge, discovered that a misconfigured 'pgbouncer=true' setting in Prisma's Supabase connection had forced every database query to make four network round-trips instead of one since March. Fixing the setting cut the availability check on the booking page from 8.06 seconds to 1.88 seconds. The discovery came the same night the team also fixed an unrelated crash caused by an image preloader overwhelming memory on mobile Safari.

blog.simbastack.com · 2026-09-15