New research from UpGuard found more than 16,000 Supabase databases exposing readable tables, with many containing signs of personal information, credentials or other sensitive data.
The security firm analyzed roughly 300,000 domains showing signs of Supabase use and identified 16,326 databases with publicly readable tables. More than half contained database fields associated with personally identifiable information, while a smaller number showed signs of passwords or authentication tokens.
Supabase provides a hosted PostgreSQL database and related backend services widely used by web applications, including apps created with AI coding tools. The exposures were largely tied to incorrect access controls rather than a vulnerability allowing attackers to bypass properly configured Supabase security.
A central safeguard is Row Level Security, or RLS, which lets developers specify which database records a user is permitted to read or modify. Supabase documents that tables exposed through its Data API should use RLS, along with appropriate database permissions.
Tables created through the Supabase Dashboard have RLS enabled automatically, but tables created through SQL or other tools require developers to enable it themselves. That distinction is particularly relevant for applications built through coding agents, which can create database structures programmatically.
UpGuard examined database schemas rather than downloading every exposed record, then investigated a smaller number of cases to confirm that some contained real sensitive information. Examples included a U.S. valet service database with information on more than 100,000 customers, an immigration service containing nearly 5,000 user records, and a database associated with a government consulate containing information on about 25,000 people.
The researchers said affected databases appeared across industries and geographic regions, suggesting the problem was not limited to a particular development platform or type of application.
One potential source of confusion is Supabase’s public API keys. The company’s API key docs say publishable keys are intended to appear in browser or application code and shouldn’t be treated as secrets. Their safety depends on database permissions and RLS policies preventing the key from accessing data it should not reach. Secret and service-role keys, however, bypass RLS and should never be exposed in client-side applications.
For developers using Supabase, the company’s current guidance is to enable RLS on every table exposed through the Data API, limit database privileges to what each role actually needs, and review policies for both signed-in and unauthenticated users. Applications created with AI coding agents require the same checks rather than assuming the generated database configuration is secure by default.
Leave a Reply