Security firm finds 16,000 Supabase-hosted databases exposed online

A cybersecurity audit by UpGuard found roughly 16,000 databases hosted on Supabase were exposing personal data to the public internet due to misconfigurations or improper security settings. The exposed datasets contained a range of sensitive information, including names, addresses, phone numbers, user passwords, and authentication tokens, according to the research shared with TechCrunch.

The security firm’s analysis identified databases linked to a variety of projects, such as an African government consulate in France, a U.S. valet service storing thousands of license plates, and an immigration and relocation service containing user contact details. UpGuard also reported instances of exposed data tied to private conversations on an Indian adult streaming site and a virtual SIM farm intercepting text messages for one-time passcode verification, often associated with fraudulent activity.

Supabase, which allows developers to build and host databases for web and app projects, has faced repeated criticism over user security practices. The company’s Chief Information Security Officer, Bil Harmer, responded to the findings by stating that Supabase operates under a 'secure by default' model and that security is a shared responsibility with customers. Harmer added that the company notifies affected users when security issues are identified and continues to improve tooling to help developers configure projects securely.

UpGuard researchers emphasized the broader implications of such exposures, noting that AI-generated and 'vibe-coded' apps—built quickly with minimal manual oversight—can inadvertently introduce security flaws or require configurations that developers may overlook. The firm’s work builds on prior research that similarly documented exposed databases on Supabase, including those used by Y Combinator startups and other widely used applications.

The incident reflects a recurring pattern in which improperly secured storage systems and databases have led to significant data breaches, exposing sensitive military communications, government files, driver’s license scans, and children’s personal information in past cases.