Cybersecurity firm UpGuard has identified more than 16,000 Supabase deployments with inadequate access controls, leaving readable tables containing personally identifiable information, credentials, and authentication tokens accessible to unauthorized parties. Analysis of the exposed table structures suggests a small fraction also contained credit card data.
Supabase, an open-source backend platform built on PostgreSQL, has gained traction among developers building applications with AI assistance. The platform now sees AI-driven development accounting for over 60% of newly created databases.
UpGuard's investigation examined roughly 300,000 domains showing Supabase usage patterns. Researchers probed for user tables and discovered that while some queries returned accessible database pages, others revealed tables under different names that were still readable. By examining table schemas, the team determined what types of sensitive data lay exposed across the affected instances.
More than half of the misconfigured databases contained personally identifiable information, with smaller subsets exposing plaintext passwords and session tokens.
Notable Exposures
The researchers documented several significant incidents across different sectors and geographies:
- A U.S. valet service exposed over 100,000 customer records with contact information, license plate numbers, and visit logs
- A Canadian immigration service had nearly 5,000 user records accessible, including 884 passwords stored in plaintext
- An India-based adult creator platform leaked sensitive identity data, payment account information, and more than 100,000 private messages
- A Philippines-based OTP service exposed data for over 2,000 users and 100,000 SMS messages, some containing unrelated personal communications
- An African government consulate left records for 25,000 individuals exposed, including residential addresses and emergency housing locations
Root Causes and Configuration Gaps
The exposures stem from poor application security configurations, particularly missing or ineffective row-level security policies and improper handling of public keys. UpGuard noted that these misconfigurations cut across all business types and sectors.
The researchers observed a pattern linking many incidents to AI-assisted development. According to UpGuard, "The security settings are invariant to business type because the humans, who know what kind of business they are advertising, do not understand their database's configuration." The firm added: "The common thread is that these sites are created by AI coding agents and the humans are unaware of the configuration."
However, UpGuard cautioned that their analysis does not definitively prove every affected application was built using AI coding agents, though the research does highlight elevated misconfiguration risks associated with AI-assisted development workflows.
Remediation Steps
UpGuard notified affected application owners when deeper analysis revealed significant data exposure. Supabase users are advised to consult the platform's security documentation, including its advisors and API security guide, to identify potential vulnerabilities and implement appropriate safeguards.