Thousands of Supabase databases leak sensitive personal data due to misconfigurations

Cybersecurity researchers have discovered that thousands of databases running on Supabase, a popular backend platform for web and app developers, are leaking sensitive personal information to the open internet. The scale of the problem underscores growing security concerns as AI-assisted development tools proliferate.

The Scope of Exposure#

According to UpGuard's security research, approximately 16,000 databases hosted on Supabase contained exposed personal data accessible to anyone with internet access. The compromised information spans names, addresses, phone numbers, and user passwords—along with a smaller number of authentication tokens.

The exposed datasets came from diverse sources and sectors:

• Private conversations on an adult streaming platform
• License plate records from a U.S. valet service
• Contact details from immigration and relocation firms
• Databases belonging to an African government consulate in France
• Infrastructure used by virtual SIM operations to intercept text messages for account verification (often tied to fraud schemes)

While most affected databases are based in the United States, researchers emphasized this is a global phenomenon.

AI and Platform Growth Collide with Security Gaps#

Supabase recently achieved a $10 billion valuation, fueled by developers using the platform to build and host their applications. However, the proliferation of AI-driven code generation—sometimes called "vibe-coding"—appears to be accelerating a new class of data exposures. Automatically generated code frequently contains security vulnerabilities, and developers may not fully understand the configuration requirements needed to keep their databases secure.

The misconfigurations typically stem from human error rather than platform vulnerabilities. Earlier research has documented similar patterns across Y Combinator startups and other popular applications using Supabase.

A Recurring Pattern#

This incident follows a broader trend of misconfigured storage systems causing major breaches. Recent years have seen exposures tied to improperly protected databases and servers containing military emails, immigration applications, classified government documents, driver's license scans, and children's personal information.