UpGuard says around 16,000 Supabase databases are exposing personal data on the public web

A Supabase project spins up as a Postgres database with a public HTTPS API attached. If nobody writes the rules that say which rows a caller may read, every row is a row that any caller on the internet may read. The question is how many deployed apps are missing those rules.

TechCrunch reports today that cybersecurity firm UpGuard has an answer: around 16,000. Security editor Zack Whittaker writes that UpGuard's research team found roughly 16,000 databases hosted on Supabase that expose some degree of personal data, including publicly readable names, addresses, phone numbers and user passwords, alongside a smaller number of passwords and authentication tokens.

What is in the exposed databases

UpGuard told TechCrunch the databases sit under a mix of small apps and larger operations. The examples the firm named to Whittaker: private conversations between users and sex workers on an Indian adult streaming site, thousands of licence plate numbers held by a US valet service, contact information for people who used an immigration and relocation service, and a database belonging to an African government's consulate in France. One of the exposed databases was running a virtual SIM farm that intercepted one-time passcodes for scam and phishing operations.

The majority of the affected datasets are located in the United States, UpGuard said, but the pattern is worldwide. The firm's report builds on earlier research by others, including audits of Y Combinator startups and a scan of 1,072 apps built with AI coding tools that found 98 percent had security flaws.

Where the misconfiguration comes from

TechCrunch's article names the pattern out loud: apps built quickly with AI coding tools, often called vibe coding, generate schemas and access paths that the person shipping them cannot fully audit. Supabase is public by default. Its Postgres row-level security policies are what stop the API from returning every row to every anonymous caller. When the model writes the schema and forgets those policies, or writes them and gets them wrong, the data is on the web the moment the project goes live. Supabase's valuation reached $10 billion in 2026, driven by this same generation of apps.

Supabase's response

Supabase Chief Information Security Officer Bil Harmer told TechCrunch the company had not seen UpGuard's research and that its projects are "secure by default", framing security as a shared responsibility with the developer. Harmer said Supabase notifies customers when security issues surface and added: "Security at Supabase is never finished. We care deeply about getting it right, and we'll keep making it easier for every developer to ship securely." UpGuard security researcher Greg Pollock said the research was intended to raise awareness of the scale of exposure.

If your product runs on Supabase, the check to run today is on your own project. Open the Supabase dashboard, list every table, and confirm three things for each one: a row-level security policy exists, the policy is tight enough that an anonymous caller reads only what an anonymous caller is supposed to read, and the policy still holds after the last schema change the model made. The tool that wrote the code does not know what the answer should be. You do.

Source

• TechCrunch, "Some Supabase customers are publicly exposing reams of people's data to the web", Zack Whittaker, 25 September 2026
• UpGuard, "Everything Everywhere: Systemic Data Exposure in Supabase Apps"