UpGuard Finds 16,000+ Misconfigured Supabase Databases Exposing Personal Data

UpGuard researchers reported on September 25, 2026 that they had identified 16,326 Supabase databases exposing readable tables, after studying roughly 300,000 domains with signs of Supabase use.

What Was Exposed

More than half of the exposed databases had schema indicators of personally identifiable information. Smaller subsets included password or authentication-token fields.

Real Organizations, Real Records

Examples ranged from a US valet service with more than 100,000 customer records to a Canadian immigration service with nearly 5,000 user records, including 884 plaintext passwords.

The Root Cause: Missing Row-Level Security

The researchers pointed to missing row-level security policies. If developers don't add those policies, tables can be readable by anyone who finds the database endpoint. They also linked the trend to AI-assisted development tools that create databases without the developer thinking about access rules.

A Checklist Problem, Not a Platform Flaw

This is a configuration failure, and it is preventable: turn on row-level security for every table, never expose service keys in front-end code, never store plaintext passwords, and test what an anonymous user can read before launch. AI-built apps need the same security review as hand-built ones.