Everything Everywhere: Systemic Data Exposure in Supabase Apps | UpGuard

UpGuard Research found thousands of misconfigured Supabase database instances (16,326 readable databases in their sample) exposing personal data, authentication tokens, plain-text passwords, OTPs and other sensitive records worldwide. The report describes the methodology (fingerprinting via BuiltWith and Chrome UX Report JS scraping), root causes (RLS defaults not applied to API-created tables, secrets in client code, and insecure patterns encouraged by AI coding agents), provides concrete exposures (e.g., 65k records with sensitive PII for an India adult platform, 100k+ CRM records, 100k OTP SMS messages), and warns of broad consumer and supply-chain risks while recommending rebalanced defaults and improved developer/agent guidance.