Security firm UpGuard found 16,326 Supabase-hosted databases publicly exposing readable tables, after scanning roughly 300,000 domains for Supabase usage in what it called the largest study of its kind, according to Unite.AI and TechCrunch.
More than half of the exposed databases showed signs of personal information, a smaller share exposed passwords or authentication tokens, and a very small number contained plausible credit card data, UpGuard found. Examples included a Philippine one-time-passcode service exposing more than 2,000 users and 100,000 text messages, a U.S. valet parking service with more than 100,000 customer records, a foreign government's consulate database with 25,000 user records, and a relocation service exposing nearly 5,000 records with passwords stored in plain text, according to Unite.AI.
The exposure traces to how Supabase handles row-level security, a Postgres feature that restricts which rows a user can read. Tables created through Supabase's dashboard Table Editor get row-level security turned on by default, but tables created through SQL, API calls or migration files, the path used by AI coding tools and agents that scaffold a database schema, do not, UpGuard's findings show.
Supabase chief information security officer Bil Harmer said the platform's projects are "secure by default" and that security is a shared responsibility. "We provide secure defaults and tooling, and customers control how their own projects are configured," Harmer told TechCrunch.
Vibe-coded apps built by pointing an agent at a database are only as safe as whichever schema-creation path the agent happened to use. If that path was SQL instead of the dashboard, the security default flips without anyone deciding it should.