More than 16,000 databases behind apps built on Supabase let anyone read their tables, according to a study by the security firm UpGuard. Its researchers found 16,326 exposed databases after scanning about 300,000 web domains that use the service.
Supabase is a popular backend for small web apps, and many of those apps are now written with AI coding tools. The study links the two. When a table is created through Supabase's API, which is how coding agents work with it, row-level security is not switched on by default. That setting decides which user may read which rows.
Without it, a table is readable by anyone who has the app's public key, and that key ships inside every copy of the app.
What sat in the tables
UpGuard says more than half of the exposed databases held signs of personal data. The researchers report names, email addresses, dates of birth and home addresses. Some tables held passwords, API tokens, payment details, and driver's license or passport numbers.
None of this required a hack in the usual sense. The data was served to whoever asked for it, because nobody had written a rule saying otherwise.
A known problem
The weakness is not new. A researcher documented it in March 2025 and it got a public vulnerability number, CVE-2025-48757. Supabase has since turned on row-level security by default for tables made in its web dashboard, the study notes, but not for tables made through the API.
That gap is where the tools now write most of the code. A developer who never opens the dashboard never sees the warning.
