Cybersecurity firm UpGuard has found around 16,000 databases hosted on Supabase that were exposing some degree of personal data to the public web. Supabase is a development platform that lets developers store and run databases behind their web and app projects, and it has grown quickly this year alongside the rise of AI-assisted 'vibe coding,' reaching a $10 billion valuation.
The exposed data included names, addresses, phone numbers, and in a smaller number of cases, passwords and authentication tokens. UpGuard cited specific examples: private conversations from an adult streaming site, license plate records from a U.S. valet service, contact details from an immigration and relocation service, records tied to an African government consulate, and a database used by a SIM farm to intercept verification texts, typically associated with scam and phishing operations.
Most of the exposed data was located in the United States, though UpGuard characterized the problem as global. The firm's findings build on earlier research that had already flagged exposed Supabase databases belonging to Y Combinator startups and other apps.
Supabase's Chief Information Security Officer, Bil Harmer, said the company had not reviewed UpGuard's specific research but described its projects as 'secure by default,' framing security as a shared responsibility between the platform and its customers. He said Supabase notifies affected customers when issues are found and continues to invest in making secure configuration easier.
The pattern is not new — misconfigured cloud storage and databases have caused breaches for years — but the scale tied to AI-assisted app building is notable. Vibe-coded apps are often built quickly by people without deep security expertise, and the underlying generated code or default database settings can leave data publicly accessible without the developer realizing it.