Security firm UpGuard says it found roughly 16,000 Supabase-hosted databases exposing some degree of personal information to the public internet. The accessible records included names, addresses, phone numbers and, in a smaller number of cases, passwords or authentication tokens.
The affected projects ranged from commercial services to government-related systems. Researchers found private conversations, vehicle license plates, immigration-service contacts and data associated with a consulate. One database was connected to a virtual SIM operation handling one-time passcodes. UpGuard described the problem as global, though most of the datasets it found appeared to be in the United States.
Supabase says its projects are secure by default and that customers control their own configurations. The company provides security tools and notifies customers when it learns about a problem. The findings nevertheless show how quickly built applications can expose sensitive information when developers do not understand database access rules. AI-assisted “vibe coding” can accelerate creation, but generated code and rushed configuration do not remove the owner’s responsibility to enable row-level access controls, test anonymous requests and audit what is reachable before launch.