Misconfigured Supabase Databases Expose Sensitive Data of Thousands

• •Over 16,000 Supabase databases exposed sensitive data due to misconfigurations.
• •AI-assisted development accounts for over 60% of newly created databases on Supabase.
• •UpGuard identified significant exposure of PII, passwords, and authentication tokens across multiple sectors.

Research by UpGuard revealed that over 16,000 databases hosted on Supabase are misconfigured, exposing sensitive personal information, passwords, and authentication tokens. The databases contain data from various sectors, including a U.S. valet service that exposed over 100,000 customer records and an African government consulate with data on 25,000 individuals. The issue stems from poor application security configurations, particularly in AI-assisted development, which accounts for over 60% of new databases. UpGuard's analysis of approximately 300,000 domains found that more than half of the exposed databases contained personally identifiable information (PII). The company has notified affected application owners regarding the significant exposure. Supabase has previously made changes to enhance security but continues to face scrutiny over its handling of user data. The findings highlight the ongoing risks associated with AI-generated code and misconfigurations in cloud services.