Security researchers from UpGuard have found that roughly 16,000 databases hosted on the backend platform Supabase are publicly exposing sensitive personal data. These misconfigured databases reveal multiple kinds of data—including names, contact details, phone numbers, passwords, license plates, private messages, and even government-related documents. Some datasets were tied to projects for adult streaming, visa and relocation services, virtual SIM operations, and even the digital operations of a foreign consulate in France. Most of the exposed datasets appear to be U.S.-based, but international leaks are also documented.
What’s Behind the Exposure
Supabase provides app and web developers a cloud-hosted database infrastructure that’s become especially popular in the wave of “vibe coding”—rapid app-building often powered by AI tools. While Supabase touts secure defaults, many users have overlooked or misconfigured essential security settings, unintentionally making sensitive databases accessible to the wider web.
UpGuard’s report highlights that while Supabase offers tools and paths for securing projects, responsibility for correctly configuring database access falls squarely on users. The exposed data ranges from innocuous user information to more alarming content, such as private conversations with sex workers and intercepted messages via virtual SIM farms used in phishing operations.
Company Response and Repercussions
Supabase’s Chief Information Security Officer, Bil Harmer, emphasized that the company operates with “secure-by-default” settings and provides tools that let customers manage their own project configurations. According to him, when security issues are identified, the company reaches out to affected customers. He reiterated that improving security is an ongoing process for Supabase.
UpGuard’s senior researcher underscored that the findings aim to raise awareness about how common and dangerous these exposures are—especially with growing reliance on platforms that simplify infrastructure overhead. These leaks illustrate broader risks tied to the speed and ease of bringing app ideas to life without fully understanding security trade-offs.
In more serious incidents, databases were found tied to organizations handling visa and relocation services, as well as private communications involving adult content. One dataset belonged to an international consulate, and others were exploited in schemes to intercept one-time passcodes via virtual SIM operations. Such leaks give malicious actors easy targets, from identity theft to credential phishing.
These vulnerabilities are part of a larger trend: the rise in breaches caused by misconfigured cloud services, storage buckets, and databases. Supabase is far from alone—but as more developers depend on platforms that abstract away infrastructure complexity, the risk of exposing privileged data through default or lax settings only grows.
To avoid such exposure, best practices include auditing access permissions, enforcing role-based access, regularly scanning for public exposure, using environment variables securely, and ensuring that production databases cannot be accessed without explicit permissions. Platform providers must continue refining and enforcing configurations that guide users toward secure setups. —Why this matters:In a cloud-native world, the biggest attack surface is often a switch or checkbox left in the wrong position. What’s exposed here isn’t just files—it’s people’s lives, private conversations, identities. As AI tools accelerate how fast apps are built, security hygiene can’t be secondary. Supabase and similar platforms must treat secure defaults not just as a feature, but as the foundation.
