UpGuard Finds Data Exposure Across 16,000 Supabase Databases

UpGuard found about 16,000 databases hosted by Supabase that exposed some personal information to the public web, according to TechCrunch. The exposed records included names, addresses, phone numbers and user passwords, while fewer databases revealed authentication tokens.

The databases contained private conversations from an Indian adult streaming site, thousands of license plates collected by a United States valet service and contact details from an immigration and relocation service. Other exposed projects included a database belonging to an African government consulate in France and a virtual SIM operation used to receive one time passcodes.

Supabase Chief Information Security Officer Bil Harmer said the company had not reviewed the research. He said Supabase projects are secure by default, customers control their configurations and the company notifies customers when it discovers security issues.