UpGuard finds 16,000 Supabase databases leaking data

Supabase's rise is tied to the boom in AI-assisted "vibe-coded" apps: developers can stand up a website or app quickly, but the generated code can carry security flaws, and the platform may need configuration the developer does not know about. UpGuard's research builds on earlier findings of exposed Supabase databases, including ones tied to Y Combinator startups and other popular apps, and the firm says it wanted to understand the scale of the problem across the platform. The examples it surfaced are varied: private conversations on an Indian adult streaming site, license plates from a U.S. valet service, contact information from an immigration and relocation service, a database belonging to an African government's consulate in France, and a virtual SIM farm used to intercept one-time passcodes.

Supabase has made changes over the years, including bolstering its platform and user access to databases, and its CISO, Bil Harmer, says the company notifies affected customers when security issues are discovered and that getting security right is ongoing work. The tension is that the two sides describe the same setup differently: UpGuard points to misconfiguration and improper security as the cause, while Supabase frames defaults as safe and configuration as the customer's responsibility.

How this plays out likely hinges on whether developers on the platform can find and fix their own exposed projects, and whether Supabase's "secure by default" position holds up if more of these datasets surface. For the startups and small teams building on Supabase, the practical question is whether their own databases are among those reachable from the open web.