16,000 Supabase Databases Expose Personal Data

16,000 Supabase Databases Expose Personal Data — Vibe-Coded Apps Blamed

Cybersecurity firm UpGuard found roughly 16,000 databases on Supabase exposing names, addresses, phone numbers, and passwords to the public web. The exposed datasets include an African government consulate in France, a virtual SIM farm used for phishing, and thousands of US valet license plates. Supabase's $10B valuation has been fueled by the boom in AI vibe-coded apps, but the research underscores how generated code often ships with critical misconfigurations.

Key Takeaways

Cybersecurity firm UpGuard found roughly 16,000 databases on Supabase exposing names, addresses, phone numbers, and passwords to the public web.
The exposed datasets include an African government consulate in France, a virtual SIM farm used for phishing, and thousands of US valet license plates.
Supabase's $10B valuation has been fueled by the boom in AI vibe-coded apps, but the research underscores how generated code often ships with critical misconfigurations.

AI synthesis1 source3

Cybersecurity firm UpGuard has published new research revealing that roughly 16,000 databases hosted on the development platform Supabase are exposing personal data — including names, addresses, phone numbers, passwords, and authentication tokens — to the public web.

The findings paint a troubling picture of the security landscape around so-called "vibe-coded" applications: software built rapidly with AI coding assistants, often by developers who lack traditional security expertise.

What Was Exposed

UpGuard's research surfaced a range of sensitive datasets across the platform:

- Private conversations with sex workers on an Indian adult streaming site - Thousands of license plates belonging to a US valet service - Contact information from an immigration and relocation service - A database belonging to an African government's consulate in France - A virtual SIM farm used to intercept one-time passcodes for phishing and scam operations

While the majority of exposed datasets appear to be US-based, UpGuard says this is a worldwide problem.

The Vibe-Coding Connection

Supabase, which recently reached a $10 billion valuation, has become a go-to backend platform for developers building apps with AI coding tools. The ease of spinning up a database with AI assistance has created a new category of security failures: generated code that ships with misconfigured database permissions, public API endpoints, or missing authentication layers.

Supabase Responds

Supabase's Chief Information Security Officer Bil Harmer described projects on the platform as "secure by default" and characterized security as a shared responsibility: "We provide secure defaults and tooling, and customers control how their own projects are configured."

Why It Matters

This incident is part of a broader pattern. As AI tools make it trivially easy to build functional applications, the gap between "it works" and "it's secure" is widening. The exposure of government consulate data and SIM farms used for interception underscores that these are not theoretical risks — real-world adversaries are already scanning for and exploiting misconfigured cloud databases.