Some Supabase customers are publicly exposing reams of people’s data to the web
UpGuard found about 16,000 Supabase databases publicly exposing personal data, including passwords and contact details.
Cybersecurity firm UpGuard told TechCrunch it found about 16,000 Supabase-hosted databases exposing some personal data to the public web. Exposed fields included names, addresses, phone numbers, and a smaller number of passwords and authentication tokens. Examples included an African government consulate in France, a U.S. valet service’s license plates, an immigration service’s contacts, and a virtual SIM farm used to intercept one-time passcodes. Supabase CISO Bil Harmer said projects are secure by default and that customers control their own configuration.
- UpGuard found about 16,000 Supabase databases exposing some personal data.
- Exposed data included names, addresses, phones, and fewer passwords and tokens.
- Cases included a consulate database and a SIM farm used for OTP interception.
- Supabase says projects are secure by default and security is shared with customers.
From the original article
3 min read at techcrunch.com
The findings highlight how AI-generated and vibe-coded apps can spill and expose users' data when not configured or secured properly.
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.