Some Supabase customers are publicly exposing reams of people’s data to the web
Supabase hosts ~16,000 databases leaking personal data worldwide, exposing names, addresses, passwords and even government consulate info.
Why Now
Security research by UpGuard uncovered widespread misconfigurations on Supabase, a popular developer platform, after the company hit a $10B valuation.
What Happened
UpGuard found about 16,000 Supabase-hosted databases with exposed personal data, including names, addresses, phone numbers, passwords, and authentication tokens. The leaks included sensitive data from an African government consulate, a virtual SIM farm, and private conversations on an adult streaming site. Supabase claims its platform is secure by default and that security is a shared responsibility with customers.
Why It Matters
These exposures highlight how easy it is for developers using AI-generated code to unintentionally create data breaches, potentially affecting millions of users and sensitive government information. It underscores the need for stricter default security and better developer education on database configuration.
The Limitation
The findings are based on publicly accessible databases; many exposed datasets may have been misconfigured rather than maliciously exposed, and the exact scope of data loss is uncertain.
What You Can Do
Review and harden your Supabase database settings, ensuring public access is disabled and sensitive data is encrypted.
Source
Read original sourceWhy we picked this
Data exposure in AI apps, meaningful AI news.