Everything Everywhere: Systemic Data Exposure in Supabase Apps

Since 2025, the database service Supabase has been known to leak data through a variety of configuration issues. Despite improvements to Supabase product security, those issues continue to exist; multiplied by Supabase’s growth as a favorite tool for Claude Code, there are now thousands of Supabase instances exposing personal information and other data. In the largest study of its kind, UpGuard Research shows how Supabase misconfigurations expose personal data for people all over the world.

Background 

You only need to look at Levi’s Stadium, home of the San Francisco 49ers, to learn the lesson of the California Gold Rush. Prospectors didn’t get rich; the people selling them picks and shovels did. Silicon Valley has taken that parable to heart. In the current AI boom, as vibe coders look to strike gold with the next Flappy Bird or Wordle, the smart money is in selling them tools. 

Supabase is one of the success stories of selling picks and shovels for the AI wave. Their flagship product, hosted Postgres as a service, is not an AI technology and does not compete with AI labs. It is a database, a core component of web applications needed for anyone who wants to try their luck at vibe coding a revenue-generating product. Through smart technical design choices, clever distribution stategies, and good timing, Supabase is an ideal product for this market and the database product most recommended by Claude Code. Riding the vibe coding growth wave has carried Supabase to a $10 billion valuation as of June 2026.

Part of the reason AI coding agents recommend Supabase is that it helps them achieve the goals they are measured on. AI models are improved through reinforcement learning; their success or failure, measured by hum an satisfaction, contributes to future choices. Working with a database product where the AI performs well leads to happy users, which leads to a greater likelihood of recommending that vendor. Supabase is designed so that AI coding agents can use it easily. It is not the first product to prioritize convenience at the expense of end user misconfiguration.

Amazon’s S3 storage service was the first cloud storage “bucket” product. It staked out a sizable chunk of market share through default settings that made it easier for users to read and write data. Those settings led to thousands of data leaks which continue to this today. Github, too, dominated competitors with a public by default model (even making users pay to have private repos) that led to countless exposures of credentials and sensitive personal information. Supabase is now in the position of mass adoption where insecure configuration patterns lead to systemic data exposures. 

In March 2025, developer Matt Turner reported widespread misconfiguration of Supabase databases created by the vibe-coding platform Lovable (tracked as CVE-2025-48757). In the simplest form of the vulnerable misconfiguration, these databases lacked a control to prevent any user from querying the database. Research on that issue led to the discovery of many other ways these databases could leak data, including policies that exist but don’t adequately restric access and public keys shared in client-side code used as if they were secret keys.

Since then, Supabase has made product changes to implement RLS by default for tables created in the Table Editor UI. Tables created programmatically through the API, which is how coding agents interact with Supabase, do not enable RLS by default. Beyond having RLS enabled, it must be configured and use credentials correctly to protect data in the database. Considering that the archetypal vibe coder is someone with minimal software engineering experience interacting with their AI coding agent rather than their code, it seems likely that these issues will continue to occur. 

Prior Research and Methodology

The vector of data exposure through Supabase configurations is well known and has been studied for more than a year; the scale of exposure and its impacts are not. Previous studies have examined it in small samples or as part of vibe-coding platforms like Lovable and Replit. Some of those studies:

• Modern Pentest scanned 107 Y Combinator startups and found 28% were exposing PII. 
• Symbiotic Security scanned 1,072 vibe-coded apps and found 39 with tables readable using the Supabase public key. 
• Escape found 175 databases leaking PII across ~1,400 vibe-coded apps
• Red Access scanned 380,000 URLs, finding 5,000 accessible apps, 2,000 of which were exposing some kind of sensitive corporate, operational, or personal data.

The methodology of starting from something like Lovable or Replit misses out on the most important contributors to sites created by AI coding agents like Claude Code and OpenAI’s Codex. Including those sites is central to studying the problem. In February of 2026, for example, Wiz discovered that the Supabase behind Moltbook, the (supposed) social media site for AI agents, was leaking all of its data: 35,000 email addresses and 1.5 million API authentication tokens. 

Rather than enumerating apps in the namespaces or bearing the watermarks of a handful of vibe-coding platforms, we wanted to identify standalone websites operating on their own primary domains. This approach would both give us a larger population–since we would be including the massive user bases of Claude Code and Codex–and include sites that are operating as real businesses and organizations, with real risk of collecting and exposing customer data. 

Sites using Supabase can be fingerprinted by looking for Supabase key names and databases addresses in public Javascript files. Doing this for one site is computationally easy; doing it for every site on the Internet requires significant resources. To accelerate our research we used results from other scanners that had pre-collected relevant data and surfaced it in easily querable formats. 

The two data sources that proved most valuable were Builtwith, which does its own technographic fingerprinting across the web, and Chrome UX Report dataset on Big Query. Builtwith provides an easy to query indication that a site uses Supabase, which then requires site crawling to identify the database address. The CrUX data provides raw Javascript files that can be queried for Supabase indicators like database addresses and API keys. These techniques could likely be re-run or expanded to find even more. 

Across these two methods we gathered ~300,000 unique domains with indicators of Supabase usage. We then queried each of those for a “users” table on the reasoning that “users” is a common table name. The database would then respond with one of three options: 

• no data was accessible (because it was forbidden by the database security policy or the database was no longer operational)
• There was no “users” table but some data was accessible. The database would then provide the name of an accessible table as a “hint.” 
• A page of results from the database. 

The “hint” mechanism ensures there is no security through obscurity, which is proverbially a bad strategy, but sometimes a little bit doesn’t hurt. 

Exposed Databases 

Distribution of data types 

Across the candidate set we identified 16,326 databases exposing readable tables. Given such a large set, we used the table schemas to assess the types of data potentially exposed in each rather than trying to read every row of every table. Over half of the databases had indicators of some PII. A smaller percentage included passwords or authentication tokens. A very small number had plausible credit card data; more commonly we found indicators that a payment system was used by the site, which was not sensitive in itself but a useful indicator of cases where attackers could insert themselves into financial transactions. 

Because many of these sites were for newly launched startups, firmographic data was not available from third parties. To classify their industry and targeted audience we scraped the front page content and used an AI model to classify the business model as B2B, B2C, hybrid, or N/A. While the overall footprint was predominantly B2C, some industries like Professional Services understandably had a greater B2B target, and two-sided markets like job boards were both. 

Impacts by industry

The types of data that different industries were more likely to expose also aligned with intuitions about what data they would need to process. Ecommerce and restaurants were the most likely to handle personal information in their exposed databases and to have integrated payment systems. I’ve ordered pizza before; I understand why they need that data. 

Unlicensed online betting, a notoriously risky is not out right criminal activity, was more likely to leak passwords and other credentials. Less obvious was the high risk of data exposure for companies selling Industrial Goods– the sites most likely to be selling to, and handling data from, corporate clients. 

Consumer and supply chain risk

Whether the site advertised a B2C or B2B service made no difference for the kinds of data likely to be exposed. The security settings are invariant to business type because the humans, who know what kind of business they are advertising, do not understand their database’s configuration. The common thread is that these sites are created by AI coding agents and the humans are unaware of the configuration. 

‍

The data skews toward PII in part because we chose to query for a “users” table. At the same time, the reason we probed for a “users” table is virtually any application will, at some point, have users. While other database types are specialized for storing other kinds of data (like search databases used for application logs or vector databases used for AI knowledge retrieval), Supabase Postgres is an ideal solution for users tables, and thus strongly correlated with that kind of data. 

Geographic distribution

These misconfigurations are happening all over the world. Often data leaks are concentrated in one region, as early adopters unaware of configuration risks are geographically co-located, and then moves to other regions where education is less accessible. Here, though, the distribution force behind Supabase appears to be global, driving similar, simultaneous behavior across all regions. 

‍

The severity of those open databases, however, is not uniform by region. Europe’s data protection laws tend to drive better practices; developing regions tend to have more data leaks. 

Exposed Data 

Schema-level analysis is the right approach for summarizing sixteen thousand databases. To validate that these case contained real data we investigated a handful where metadata indicated likelihood of meaningful data exposures. In the cases where we determined a significant exposure, UpGuard notified the application owners. 

India OnlyFans-like site

65,467 individuals were counted in the users table. In addition to the regular PII like name, email address, DOB and address, this table also contained fields for driver’s license information, passport details, PAN card numbers and the last 4 digits of Aadhar numbers. Tied to this PII was financial data including payout accounts (PayPal, Payoneer, Zelle, crypto wallet, bank) and Stripe account information, including last 4 digits of cards. Another table, messages, contained over 100,000 private messages to and from adult content creators on the platform. 

Phillipines OTP service 

UpGuard has previously reported on the cybercrime supply chain, and one of the most important links in that chain is the Sim Farm, where massive amounts of phone sims are used to register fake accounts on various platforms. These phones receive OTP codes for account verification and help to balloon users for scams and illegal operations on Telegram and other social media apps.

This exposed Supabase db contained over 2,000 users with email addresses, phone numbers, wallet balances and other details, as well as over 100,000 SMS messages with OTP codes, sender IDs and SIM codes. Although 95% of the messages were OTP codes, between 2,000-2,400 messages of our sample contained real person-to-person SMS texts. These texts were nearly all ridesharing communications between drivers and passengers in the Philippines. These people appear to be unrelated to the SIM farm, and are instead collateral exposure due to the huge swathe of phone numbers being passed through. 

US-based valet service 

Another exposed Supabase db belonged to a Valet service, acting as their CRM back end. Over 100,000 customers were exposed this time, each with a phone number, about 43,000 of them with email addresses and full names, and about 78,000 with license plate numbers. Also included were each customer’s visit history, lifetime value, tip history and a free-text notes field. An additional users table contained 665 records of employed staff, including email addresses, phone numbers and push tokens. 

This business is based in the US Northeast area. About 11% of the exposed email addresses (4,560) are third-party corporate domains, many identifiable regional employers including universities and Fortune 500 companies.

African consulate

This misconfigured Supabase db contains 25,000 users with PII and physical addresses for a consulate operated by an African national government. The nature of the operation means the 25,000 people exposed here belong to a vulnerable population. Another field identifies in which emergency housing location individuals are currently residing.

Canadian immigration/relocation service

Another service for which we discovered an exposed Supabase db provided relocation and immigration coaching and advice for people moving to Canada. Of the nearly 5,000 records in the users table, almost all of them contained full names, email addresses, phone numbers and DOBs, while 884 of them had a plain text password stored as well.

Conclusion

As UpGuard Research has been documenting for almost a decade, data leaks are the multiplicative product of a technology’s ease of misconfiguration and the size of its user base. A small number of technologies have achieved both. Indeed, doing so is a sign of market success. But it also a sign that its time to rebalance the equation, as S3 and Github have done. As the nearly default database choice for vibe-coded apps, when humans or their AI coding agents misunderstand how to implement good security configuration, the impacts land across the world, across every industry, across every business model, hidden in plain sight until someone looks. 

‍