16,000 Supabase databases exposed as vibe-coded apps leak sensitive user data
Over half of the databases showed indicators of personally identifiable information.
- UpGuard found 16,326 Supabase databases with publicly readable tables exposed to the internet.
- More than half showed signs of personal information, with some exposing credentials and rare payment data.
- Researchers confirmed real data leaks affecting services in India, the Philippines, the US, Africa, and Canada.
- Supabase says projects are secure by default, but customers control how their databases are configured.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Developer misconfigurations left data exposed to the open internet across more than 16,000 Supabase databases, researchers found.
Cybersecurity firm UpGuard identified 16,326 Supabase databases with publicly readable tables, more than half of which showed indicators of personally identifiable information.
Supabase is an open-source platform that provides backend infrastructure for apps and is often used with AI coding tools. It’s now valued at $10 billion following its 2026 funding round.
However, database misconfigurations have been a recurring security issue. The researchers said that the platform had been known “to leak data through a variety of configuration issues” since 2025.
In March 2025, developer Matt Turner discovered widespread misconfigurations in Supabase databases created by the vibe-coding platform Lovable.
Further research uncovered other ways in which databases leaked data, including inadequate access controls and public keys being treated as if they were secret keys. And just recently, a separate flaw in Lovable exposed users’ source code, database credentials, AI chat histories, and customer data.
Supabase has since introduced additional safeguards, but researchers said they aren't automatically applied when databases are created through coding tools. But even when these safeguards are enabled, developers still need to configure them correctly to prevent unauthorized access.
UpGuard wanted to understand the scale of exposed data. Over half of the identified 16,326 Supabase databases appear to leak personally identifiable information; a smaller percentage potentially expose passwords, authentication tokens, and, in rare cases, credit card data.
The type of exposed data varied by industry, with e-commerce and restaurant apps most likely to have personal information and integrated payment systems in their exposed databases, and unlicensed online betting more likely to leak passwords and other credentials.
UpGuard investigated a sample of the databases to confirm that the cases contained real data. Among them was an India OnlyFans-like site exposing data on more than 65,000 people, including passport and driver’s license details, financial information, and over 100,000 private messages.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Other cases included a Philippines-based OTP service exposing over 100,000 SMS messages with OTP codes, a US valet service exposing information on over 100,000 customers, and an African consulate database containing personal and location information on 25,000 people. A Canadian immigration service also exposed nearly 5,000 records, including 884 accounts with passwords stored in plain text.
TechCrunch reached out to Supabase Chief Information Security Officer Bil Harmer, who said that while the company has not seen the research, its projects are “secure by default.”
“We provide secure defaults and tooling, and customers control how their own projects are configured,” Harmer said, adding that the company notifies affected customers when security issues are discovered.
