Around 16,000 databases hosted on development platform Supabase are spilling people's personal information onto the public internet, according to new security research published September 25 by cybersecurity firm UpGuard. The findings reveal how quickly built "vibe-coded" apps—websites and applications created using AI coding tools—can leak sensitive data through simple security mistakes and improper setup. Supabase, which hit a $10 billion valuation earlier this year thanks to a surge in developers using the platform to host AI-generated apps, has drawn scrutiny over how it manages user security.
UpGuard's research uncovered publicly accessible names, home addresses, phone numbers, and user passwords across the exposed databases. Authentication tokens and passwords appeared in smaller quantities. The leaked information came from a variety of projects: private messages exchanged with sex workers on an Indian adult streaming platform, thousands of license plate numbers from a U.S. valet company, and contact details from people who used an immigration and relocation service. One database belonged to an African government's consulate in France, while another supported a virtual SIM farm that intercepts text messages to grab one-time passcodes for verifying online accounts—typically used for scams and phishing schemes. Though most of the exposed datasets appear to sit in the United States, UpGuard characterized this as a global problem.
Supabase's Chief Information Security Officer Bil Harmer said the company's projects are "secure by default" and described security as a shared responsibility between the platform and its customers. "We provide secure defaults and tooling, and customers control how their own projects are configured," Harmer stated, adding that the company alerts affected customers when security problems are discovered. UpGuard security researcher Greg Pollock said the company's work mattered for raising awareness about data exposures. The research expands on earlier findings that also turned up a range of exposed databases on Supabase, including those run by Y Combinator startups and other well-known apps.
The exposures illustrate how AI-powered code generation can fuel data breaches when developers lack security knowledge. While AI tools let people quickly build websites and apps, the code they produce often contains security holes, or the finished applications need specific configurations that creators don't understand. Over the years, countless breaches have stemmed from storage servers, databases, and websites set up incorrectly—resulting in leaks of sensitive military emails, immigration and visa applications, classified government documents, hundreds of thousands of driver's license scans, and children's personal details. The current boom in AI vibe-coding is driving a fresh wave of such incidents, with many now connected to Supabase as more people choose it for data storage.
Supabase has updated its platform over the years, including strengthening its infrastructure and user access to databases. Harmer emphasized that "security at Supabase is never finished" and pledged the company will "keep making it easier for every developer to ship securely." There are well-documented cases of users misconfiguring or unknowingly opening their databases to the broader internet, sometimes exposing millions of records at once. Platforms that lower the barrier to app development face a structural tension: making creation accessible can multiply the number of projects launched by builders who don't yet grasp security fundamentals, and no amount of default hardening fully compensates when configuration choices remain in inexperienced hands.