Breaches and incidents
Supabase-hosted apps: UpGuard finds about 16,000 databases with publicly readable tables
UpGuard said “we identified 16,326 databases exposing readable tables” out of about 300,000 domains showing Supabase use.
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- UpGuard said “we identified 16,326 databases exposing readable tables” out of about 300,000 domains showing Supabase use; over half had indicators of PII, a smaller share included passwords or authentication tokens, and a very small number had plausible credit card data (UpGuard; TechCrunch; BleepingComputer).
- Root cause: customer misconfiguration, per UpGuard and BleepingComputer: missing or ineffective Row Level Security (tables created through the API, which coding agents use, “do not enable RLS by default”) and public client-side keys used as if secret.
- No attacker named; UpGuard has not reported malicious third-party access.
- Supabase CISO Bil Harmer said “We provide secure defaults and tooling, and customers control how their own projects are configured” (TechCrunch); UpGuard said Supabase enabled RLS by default for tables created in the Table Editor UI but not for API-created tables, and that it notified owners where it found significant exposure.
Sources
- https://techcrunch.com/2026/09/25/some-supabase-customers-are-publicly-exposing-reams-of-peoples-data-to-the-web/
- https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps
- https://www.bleepingcomputer.com/news/security/misconfigured-supabase-apps-expose-data-in-over-16-000-databases/