Security firm UpGuard has identified roughly 16,000 databases hosted on development platform Supabase that were publicly exposing personal data, according to a report from TechCrunch. The exposed information included names, addresses, phone numbers, and user passwords, as well as smaller numbers of authentication tokens. The databases were tied to a range of projects, including an Indian adult streaming site's private conversations, a U.S. valet service's license plates, and an immigration and relocation service's contact lists. One database belonged to an African government's consulate in France, and another was used to intercept text messages for sending one-time passcodes, typically in scams and phishing attacks.
The findings come as Supabase, which reached a $10 billion valuation earlier this year, has seen a surge in developers hosting AI-generated "vibe-coded" apps on its platform. UpGuard's research highlights how basic misconfigurations in these apps can lead to large-scale data exposure. While most exposed datasets appeared to be in the United States, UpGuard said the problem is worldwide. The research builds on earlier work that found exposed Supabase databases belonging to Y Combinator startups and other popular apps.
In response, Supabase's Chief Information Security Officer Bil Harmer said the company had not seen the research but that its projects are "secure by default." He described security as a shared responsibility, adding that Supabase provides secure defaults and tooling while customers control their own project configuration. Harmer said the company notifies affected customers when security issues are discovered, and that "security at Supabase is never finished." UpGuard researcher Greg Pollock said the research was important for raising awareness about data exposures.