NewsPublished 28 Sep 2026

Misconfigured Supabase apps expose data in over 16,000 databases

Source Bleeping Computer

Description

Researchers discovered over 16,000 Supabase databases misconfigured to expose readable tables containing personally identifiable information, passwords, and authentication tokens. The exposed data includes sensitive records from various sectors such as a U.S. valet service, a Canadian immigration service, an India-based adult platform, a Philippines OTP service, and an African government consulate. The root cause is poor security configurations, including missing or ineffective row-level security policies and misuse of public keys, often linked to AI-assisted app development. Supabase users are advised to review security documentation to mitigate exposure risks.

Impact

The exposure of sensitive data such as PII, passwords, authentication tokens, credit card information, private messages, and SMS communications can lead to privacy violations, identity theft, unauthorized access, and potential fraud. The affected data spans multiple sectors and countries, increasing the risk of widespread harm. The root cause being misconfiguration rather than a software flaw means the impact depends on individual application security practices.

Defensive guidance

Supabase users should review and apply the platform's security documentation, including its advisors and API security guide, to identify and remediate exposure risks. Implementing proper row-level security policies and correct use of authentication keys is critical. Application owners should audit their database configurations, especially if using AI-assisted development tools, to ensure sensitive data is not publicly accessible.

Summary

Security researchers at UpGuard analyzed approximately 300,000 domains using Supabase and found more than 16,000 databases with misconfigurations exposing readable tables. These tables contained personally identifiable information (PII), passwords, authentication tokens, and in some cases credit card data. The exposures spanned multiple industries and countries, with notable incidents including over 100,000 customer records exposed by a U.S. valet service and nearly 5,000 user records with plaintext passwords at a Canadian immigration service. The misconfigurations stem from missing or ineffective row-level security policies and improper use of public keys. The researchers highlighted that many affected sites were created using AI coding agents, leading to human unawareness of insecure database configurations. UpGuard notified affected application owners and recommends reviewing Supabase's security guidelines to address these issues.

References

bleepingcomputer.com/news/security/misconfigured-supabase-apps-expose-data-in-over-16-000-databases/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Sep 2026, 19:02 UTC

References

Community reviews