Thousands of apps built on a popular backend platform have been leaving user records readable by anyone who knows where to look. Security firm UpGuard says it found 16,326 Supabase databases with publicly readable tables. That is the finding behind a report that has drawn fresh attention this week.
According to Cybernews, which summarised the research, more than half of those databases showed signs of personal information. The exposed material included user records, one-time passcodes, credentials and, in rarer cases, payment data.
What UpGuard found
Supabase is an open-source platform that provides backend services for apps. Cybernews notes it is often used alongside AI coding tools. TechCrunch reported that the company reached a $10 billion valuation earlier this year, helped by a surge in developers hosting so-called vibe-coded apps on it. TechCrunch also said the company has faced criticism over how it handles user security.
UpGuard analysed the databases at the schema level, which means it looked at table structures and metadata rather than reading every record. To check that the exposures were real, it examined a handful of cases where the metadata suggested meaningful data was at stake. Where it confirmed a significant exposure, it notified the app owners.
One example in UpGuard’s write-up involved a platform with 65,467 people in its users table. Alongside names, email addresses, dates of birth and addresses, the table held driver’s licence details, passport details, PAN card numbers and the last four digits of Aadhaar numbers. Financial fields were tied to those profiles, including payout accounts and partial card details from Stripe. A separate messages table held more than 100,000 private messages to and from adult content creators on the platform.
Cybernews reports that the researchers confirmed real leaks affecting services in India, the Philippines, the US, Africa and Canada.
Supabase’s position
Supabase says its projects are secure by default, according to Cybernews. The company also points out that customers decide how their databases are configured. In other words, the exposure stems from developer settings, not a break-in at Supabase itself.
That is not a new problem. UpGuard said the platform has been known to leak data through various configuration issues since 2025. Cybernews recalls that in March 2025 a developer, Matt Turner, found widespread misconfigurations in Supabase databases created by the vibe-coding platform Lovable.
The Privacy Guides weekly roundup, which listed the story among the week’s breaches, framed the lesson plainly: AI-generated and vibe-coded apps can expose user data when they are not set up and secured properly.
What users can do
Ordinary users cannot see how an app stores their data, so the advice is mostly about limiting damage. These steps are general good practice and do not come from the report.
- Be cautious with new or little-known apps, especially those that ask for identity documents or payment details.
- Use a unique password for every service, so a leaked credential does not unlock other accounts.
- Turn on app-based two-factor authentication where offered.
- Watch for phishing emails or texts that use personal details to look convincing, particularly if you have used a small app recently.
- If a company tells you your data was exposed, change the password, review linked payment accounts and consider a credit freeze if identity documents were involved.
What developers should check
For anyone shipping an app on Supabase or a similar service, the research points to access settings as the weak spot. Review which tables can be read without signing in. Test the app as an anonymous visitor. Avoid storing sensitive identity documents or payment fields unless they are truly needed, and treat code generated by AI tools as something to audit, not to trust by default.
UpGuard has not said the 16,326 databases were all copied by attackers. What it has shown is that the data was reachable. Whether anyone else found it first is not established in the sources reviewed.