Supabase Customers Expose Sensitive Data Due to Misconfigurations
New research by UpGuard has revealed that thousands of databases hosted on Supabase are exposing sensitive personal data due to misconfigurations. The cybersecurity firm identified around 16,000 such instances where names, addresses, phone numbers, and even passwords were publicly accessible online. These exposures include private conversations from an Indian adult streaming site, license plates linked to a U.S. valet service, and contact information for users of immigration services. The issue highlights the growing risks associated with AI-generated code and 'vibe-coded' apps that developers are increasingly using without understanding proper security configurations. Supabase has faced criticism in the past over user data exposure incidents, including leaks involving government files and personal records. The company claims its platform is secure by default but emphasizes that users bear responsibility for their own project settings. UpGuard's findings underscore a global problem with improperly configured databases across platforms like Supabase, which have been used to host projects from Y Combinator startups and other popular apps.
