Security researchers at UpGuard analyzed approximately 300,000 domains using Supabase and found more than 16,000 databases with misconfigurations exposing readable tables. These tables contained personally identifiable information (PII), passwords, authentication tokens, and in some cases credit card data. The exposures spanned multiple industries and countries, with notable incidents including over 100,000 customer records exposed by a U.S. valet service and nearly 5,000 user records with plaintext passwords at a Canadian immigration service. The misconfigurations stem from missing or ineffective row-level security policies and improper use of public keys. The researchers highlighted that many affected sites were created using AI coding agents, leading to human unawareness of insecure database configurations. UpGuard notified affected application owners and recommends reviewing Supabase's security guidelines to address these issues.

The exposure of sensitive data such as PII, passwords, authentication tokens, credit card information, private messages, and SMS communications can lead to privacy violations, identity theft, unauthorized access, and potential fraud. The affected data spans multiple sectors and countries, increasing the risk of widespread harm. The root cause being misconfiguration rather than a software flaw means the impact depends on individual application security practices.

No official patch is applicable as this is a misconfiguration issue. Supabase users should review and apply the platform's security documentation, including its advisors and API security guide, to identify and remediate exposure risks. Implementing proper row-level security policies and correct use of authentication keys is critical. Application owners should audit their database configurations, especially if using AI-assisted development tools, to ensure sensitive data is not publicly accessible.