Sunday 4 October 2026
Afternoon EditionRSS
ZOTPAPER

News without the noise

ZOTPAPER
Security

Supabase databases expose sensitive data of thousands of users, UpGuard finds

AI-driven 'vibe-coding' boom linked to misconfigurations that leave personal information publicly accessible

By LineZotpaper
Published
Read Time1 min
Sources2 outlets
Cybersecurity firm UpGuard has identified approximately 16,000 databases hosted by development platform Supabase that are exposing sensitive personal data to the public internet, including names, addresses, phone numbers, and passwords. The findings underscore how misconfigurations in AI-generated applications are fueling a new wave of data breaches.

UpGuard's research, reported by TechCrunch, found that these databases were accessible due to basic security misconfigurations by developers using Supabase. The exposed data included private conversations from an Indian adult streaming site, thousands of license plates from a U.S. valet service, and authentication tokens. Supabase, which reached a $10 billion valuation earlier this year, has faced criticism over its security posture. The company has seen a surge in usage as developers increasingly rely on AI tools to rapidly build and deploy 'vibe-coded' apps, often without proper security awareness.

This pattern echoes a long history of data breaches linked to improperly configured storage servers, which have previously leaked sensitive military emails, immigration applications, and children's personal data. UpGuard said its goal was to understand the scale of exposure across the platform, and found that the databases hosted by Supabase contained a range of personal information, though passwords and authentication tokens were less common.

§

Analysis

Why This Matters

  • The exposure puts thousands of individuals' personal data at risk of misuse, including identity theft and fraud.
  • It highlights the security pitfalls of the 'vibe-coding' trend, where AI-generated code may lack proper security configurations.
  • Raises questions about the responsibility of platforms like Supabase to enforce security defaults or educate users.

Background

Supabase is a popular backend-as-a-service platform that lets developers quickly create and host databases. It has recently seen explosive growth as AI coding tools make it easier to build applications without deep security expertise. 'Vibe-coding' refers to the practice of using large language models to generate code iteratively, often prioritizing speed over security. Misconfigured cloud storage and databases have been a recurring cause of data breaches for years, affecting everything from government systems to commercial apps.

Key Perspectives

Supabase: The company may argue that security is ultimately the responsibility of the developer configuring their database, and that it provides tools for securing access. UpGuard: The cybersecurity firm views the findings as evidence of a systemic problem where platform defaults and user ignorance combine to create widespread data exposure. Critics/Skeptics: Some argue that the reliance on AI-generated code without proper review is irresponsible, and that platforms need to do more to prevent such exposures by default.

What to Watch

  • Supabase's official response and any security changes it may announce.
  • Whether regulators or privacy watchdogs investigate the exposures.
  • The adoption of security-by-default configurations in AI-assisted development tools.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workReport an errorSubscribe