Some Supabase customers are publicly exposing reams of people’s data to the web

Security researcher UpGuard found approximately 16,000 Supabase-hosted databases publicly accessible due to misconfiguration, exposing personal data (names, addresses, phone numbers), some passwords and authentication tokens, and sensitive project-specific datasets (including a consulate, SIM farm intercepts, and immigration service records); the report warns this widespread exposure—driven in part by AI-generated code and developer misconfiguration—creates significant risk for identity theft, scams, phishing, and other misuse.