UpGuard finds roughly 16,000 Supabase databases exposing personal data

Security firm UpGuard says it found around 16,000 databases hosted on Supabase that were exposing personal data to the open web, TechCrunch reported on September 25. Supabase is the development platform many builders use to store and run the databases behind their web and mobile apps.

According to UpGuard, the exposed data included names, addresses, phone numbers and a smaller number of user passwords and authentication tokens. The goal of the research was to measure how much data across the platform could be reached from the public internet rather than to break in.

The examples are specific: private conversations with sex workers on an Indian adult streaming site, thousands of license plates belonging to a US valet service, and the contact details of people who used an immigration and relocation service. One of the databases belonged to an African government's consulate in France, while another was used by a virtual SIM farm to intercept one-time passcodes, the kind of setup typically tied to scams and phishing.

UpGuard says most of the exposed datasets appear to be located in the United States but describes the problem as worldwide. The findings build on earlier research that also surfaced exposed databases hosted on Supabase, including those of Y Combinator startups and other popular apps.

The backdrop is the vibe-coding boom. Supabase reached a $10 billion valuation earlier this year as more developers hosted AI-generated apps on the platform, but the company has also faced criticism over how it handles user security.

Supabase's Chief Information Security Officer Bil Harmer said the company has not seen the research and described its projects as "secure by default." He framed security as a shared responsibility: the platform provides secure defaults and tooling, customers control how their own projects are configured, and the company notifies affected customers when it finds issues. "Security at Supabase is never finished," he said.

UpGuard security researcher Greg Pollock said the research was important for raising awareness of data exposures. Misconfigured storage servers, databases and websites have leaked military emails, immigration and visa applications, classified government files and hundreds of thousands of driver's license scans over the years.

What makes the case worth watching is where responsibility lands. When AI makes it trivial to ship an app, the unglamorous basics such as database permissions and access rules are exactly the steps most likely to be skipped, and a "secure by default" claim only covers the configuration the platform itself controls.