Misconfigured Supabase apps expose data in over 16,000 databases
UpGuard found over 16,000 misconfigured Supabase databases exposing PII, passwords, tokens, and some payment data.
UpGuard analyzed about 300,000 domains using Supabase and found more than 16,000 databases with readable tables. More than half exposed personally identifiable information, and a smaller subset included passwords, authentication tokens, or limited credit-card data. Notable cases included a U.S. valet service with over 100,000 customer records, 884 plaintext passwords among nearly 5,000 records at a Canadian immigration service, and 25,000 records at an African government consulate. Researchers blamed weak row-level security and public-key misuse, often on AI-built sites, and notified owners of significant exposures.
- More than 16,000 Supabase databases exposed readable tables.
- Over half held PII; a smaller set included passwords or tokens.
- A U.S. valet service leaked over 100,000 customer records.
- Causes include missing row-level security and public-key misuse.
- AI coding agents are common, but not confirmed for every site.
Full article494 words · extracted from bleepingcomputer.com · click to collapse
Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens.
Based on the analysis of table schemas, researchers at cyber risk management company UpGuard believe that a very small set of the exposed information includes credit card data.
Supabase is an open-source development platform built around PostgreSQL that provides developers with a range of backend services to build and launch apps and websites faster.
The service has become increasingly popular among developers using artificial intelligence tools to build projects, with AI-assisted development accounting for more than 60% of newly created databases.
UpGuard researchers analyzed a dataset of around 300,000 domains that showed signs of using Supabase and checked for a 'users' table. While some queries returned a page from the database, others hinted that the 'users' table did not exist, but a table with another name was accessible.
The researchers then used the table schemas to infer the data types exposed across the set. In more than half of the exposed databases, UpGuard found personally identifiable information (PII), with a smaller subset including passwords and authentication tokens.
Source: UpGuard
Among the more notable findings was a U.S. valet service that exposed more than 100,000 customer records, including contact details, license plates, and visit history.
At a Canadian immigration service, the researchers said they found nearly 5,000 user records, including 884 plaintext passwords.
Sensitive identity, payment accounts, and over 100,000 private messages were found at an India-based adult creator platform, UpGuard says.
A Philippines-based OTP service exposed data on more than 2,000 users and 100,000 SMS messages, including some apparently unrelated person-to-person communications.
An African government consulate exposed records belonging to 25,000 people, including addresses and emergency housing locations.
The researchers attribute the exposure to poor application security configurations, including missing or ineffective row-level security policies and misuse of public keys.
UpGuard explained that the security issues are not limited to a particular type of business:
“The security settings are invariant to business type because the humans, who know what kind of business they are advertising, do not understand their database’s configuration,” UpGuard explains.
“The common thread is that these sites are created by AI coding agents and the humans are unaware of the configuration.”
Despite highlighting the increased risk of misconfigurations with AI-assisted app development, the researchers stressed that their scans do not establish that every affected site was built using an AI coding agent.
UpGuard said it notified application owners when its deeper analysis identified significant exposure.
Supabase users are encouraged to review the platform’s security documentation, including its advisors and API security guide, to identify exposure risks and mitigate them.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.