Skip to content
WorldBrand.AI

Supabase controversies

Controversies tied to this brand in public sources. A listing is not a finding of fault.

Back to profile1 entries

  1. 2026

    UpGuard research finds around 16,000 Supabase-hosted databases publicly exposing personal data

    Issue disclosure

    In September 2026, cybersecurity firm UpGuard published security research reporting that thousands of databases hosted by development platform Supabase were exposing sensitive information to the public web. UpGuard told TechCrunch it identified around 16,000 Supabase-hosted databases on which some degree of personal data was exposed, including publicly accessible names, addresses, phone numbers and user passwords, as well as a smaller number of passwords and authentication tokens. The findings were described as highlighting how AI-generated and vibe-coded applications can spill or expose sensitive data through basic misconfigurations and improper security.

    Cybersecurity firm UpGuard published new security research finding that thousands of databases hosted by development platform Supabase are exposing people's sensitive information to the public web. UpGuard told TechCrunch it found around 16,000 databases on which some degree of personal data was exposed while hosted by Supabase, including publicly accessible names, addresses, phone numbers and user passwords, and a smaller number of passwords and authentication tokens. The findings highlight how AI-generated and vibe-coded apps can spill or expose sensitive data through basic misconfigurations and improper security.

    Stated objective. To understand the scale of exposed data across the Supabase platform

    Source excerpt

    • UpGuard told TechCrunch that it found around 16,000 databases on which some degree of personal data was exposed while they were hosted by Supabase, which allows web and app developers to store and run their databases.
    • UpGuard says it sought to understand the scale of exposed data across the platform, and found publicly accessible names, addresses, phone numbers, and user passwords. The research surfaced a fewer number of passwords and authentication tokens.
    Source