Controversies

UpGuard research finds around 16,000 Supabase-hosted databases publicly exposing personal data

Issue disclosure

Cybersecurity firm UpGuard published security research finding that thousands of databases hosted by development platform Supabase expose sensitive information to the public web. UpGuard told TechCrunch it found around 16,000 databases on which some degree of personal data was exposed while hosted by Supabase, including publicly accessible names, addresses, phone numbers and user passwords, and a smaller number of passwords and authentication tokens. The findings highlight how AI-generated and vibe-coded apps can spill or expose sensitive data through basic misconfigurations and improper security.

Cybersecurity firm UpGuard published new security research finding that thousands of databases hosted by development platform Supabase are exposing people's sensitive information to the public web. UpGuard told TechCrunch it found around 16,000 databases on which some degree of personal data was exposed while hosted by Supabase, including publicly accessible names, addresses, phone numbers and user passwords, and a smaller number of passwords and authentication tokens. The findings highlight how AI-generated and vibe-coded apps can spill or expose sensitive data through basic misconfigurations and improper security.

Stated objective. To understand the scale of exposed data across the Supabase platform

Microsoft Power Apps portals expose personal data

Issue disclosure

Researchers at UpGuard reported that Microsoft Power Apps portals configured to allow public access exposed 38 million records containing personal information. The report said the data breaches had been fixed.