Over 16,000 misconfigured Supabase databases expose personal data passwords and auth tokens

UpGuard found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens, with a very small subset appearing to include credit card data. Supabase is an open-source PostgreSQL development platform, popular with developers using AI tools, which now account for more than 60 percent of newly created databases. UpGuard analyzed about 300,000 domains showing Supabase use and inferred exposed data types from table schemas. More than half of the exposed databases held PII, with a smaller subset exposing passwords and tokens. One US valet service alone exposed over 100,000 customer records, showing how missing access controls turn convenient backends into open data stores.

Check

Audit Supabase projects for tables readable without authentication, enable row-level security and proper policies, and rotate any exposed tokens or passwords.

Affected

Supabase projects deployed without row-level security or access policies expose their tables, leaking PII, credentials, and auth tokens to anyone who queries them.

Fix

Turn on row-level security, restrict anonymous access, review AI-generated backends for missing controls, and monitor for unauthorized table reads.