Supabase Misconfigurations Expose 16,000 Databases

UpGuard researchers found over 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, and authentication tokens. More than half contained PII, with a smaller subset including passwords and tokens. Notable cases include a U.S. valet service exposing 100,000 customer records and a Canadian immigration service leaking 884 plaintext passwords. UpGuard attributes the exposures to poor row-level security and misuse of public keys, often in AI-built apps.