Cybersecurity firm UpGuard has identified around 16,000 Supabase-hosted databases that are exposing personal data to the open internet, a scale of leakage that tracks the rapid rise of AI-generated apps built on the platform. The exposed records include names, addresses, phone numbers and, in some cases, passwords and authentication tokens. Supabase reached a $10 billion valuation earlier in 2026 as developers flocked to it to host their vibe-coded projects.
The exposures are not the result of a single breach but of thousands of individual misconfigurations. In some instances, single databases were leaking millions of records each. UpGuard's sweep found the problem is global, though the majority of affected datasets appear to sit on infrastructure in the United States.
The catalogue of what's exposed reads like a taxonomy of modern app-building. UpGuard cited private conversations with sex workers on an Indian adult streaming site, thousands of license plates from a US valet service, and the contact information of people who used an immigration and relocation service. One database belonged to an African government's consulate in France. Another was used by a virtual SIM farm to intercept one-time passcodes, a technique typically deployed for phishing and account-takeover scams.
Key facts
- 01UpGuard identified roughly 16,000 Supabase-hosted databases exposing some degree of personal data to the public internet.
- 02Supabase reached a $10 billion valuation earlier in 2026 as vibe-coded apps drove adoption of the platform.
- 03Exposed data included names, addresses, phone numbers, passwords and, in fewer cases, authentication tokens.
- 04Individual leaks reached into the millions of records, spanning an African consulate in France, a US valet service, and an Indian adult streaming site.
- 05Supabase CISO Bil Harmer said projects are 'secure by default' and framed security as a shared responsibility with customers.
The through-line is vibe coding. AI tools now let developers with limited security background scaffold an entire app and stand up a live backend in an afternoon. The generated code often ships with default configurations that leave data tables readable to anyone on the internet, and the developer may never realise the setting exists. Supabase, which gives web and mobile developers a hosted database and authentication layer, has become one of the default destinations for these projects.
The pattern is familiar. Misconfigured storage buckets and databases have driven data breaches for years, spilling military emails, immigration files, driver's licence scans and children's records. What is new is the pipeline feeding the problem — AI assistants generating apps at a pace that outstrips the security review those apps would traditionally receive.
Supabase Chief Information Security Officer Bil Harmer said the company had not seen the UpGuard research but that its projects are 'secure by default.' He framed security as a shared responsibility between Supabase and the developers who build on it.
“We provide secure defaults and tooling, and customers control how their own projects are configured”— Bil Harmer, Supabase Chief Information Security Officer
Harmer added that Supabase notifies affected customers when security issues are discovered and pointed to ongoing platform work to tighten database access. He said the company would keep making it easier for developers to ship securely.
UpGuard security researcher Greg Pollock said the firm's work was important for raising awareness about data exposures. The 16,000 figure builds on earlier UpGuard research that had already flagged exposed Supabase databases tied to Y Combinator startups and other widely used apps, suggesting the problem has been visible for some time and is growing with the platform.
The shared-responsibility defence is standard for cloud and backend providers, and it is technically accurate — a customer who ticks the wrong permission box owns that decision. It also collides with the reality of the user base Supabase is now serving. A developer prompting an LLM to 'add a login system' is unlikely to audit row-level security policies before pushing to production.
For Supabase, the commercial case that got the company to a $10 billion valuation and the security case are now the same case. The vibe-coding wave that drove growth is the same wave producing the 16,000-database tail. Tightening defaults, forcing explicit opt-ins for public tables, and surfacing exposure warnings inside the developer workflow would cost some friction at signup and likely prevent a large share of the leaks UpGuard is finding. Whether the platform absorbs that friction, or continues to route it to customers who cannot evaluate it, will shape how the next wave of AI-built apps handles the personal data flowing through them.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
