Researchers Find 16,000 Exposed Databases Behind AI-Built Apps

Security researchers say they found more than 16,000 publicly accessible databases built on Supabase, a widely used backend platform for AI-generated applications, leaking names, phone numbers, passwords and in some cases government identification numbers to anyone who queried the right web address.

The findings, published by the cybersecurity firm UpGuard on September 25, describe what the company calls the largest study to date of exposure tied to "vibe coding," the practice of generating working software largely through natural-language prompts to AI tools rather than hand-written code. Supabase pairs a hosted Postgres database with the kind of client-facing API that lets an app talk to it directly from a browser, a combination that has made it one of the most common backends behind AI-scaffolded apps. That convenience, UpGuard argues, is also what let so much data leak.

What the researchers found

UpGuard's team, led by director of research Greg Pollock, fingerprinted roughly 300,000 domains carrying Supabase indicators using commercial site-technology data and Google's Chrome User Experience Report dataset, then queried each one for a database table named "users." Of those, 16,326 returned readable data. More than half showed signs of containing personal information, and a smaller share exposed passwords, authentication tokens or payment-related fields, according to the report, first covered by TechCrunch.

The case studies UpGuard documented span several countries and industries:

• An India-based adult content platform left roughly 65,000 user records exposed, including government ID numbers, payment-service details and more than 100,000 private messages.
• A valet-parking service in the northeastern United States exposed contact information and vehicle data for more than 100,000 customers, plus records for 665 employees.
• A database tied to an African country's consulate in France exposed roughly 25,000 records, including home addresses.
• A Canadian immigration-consulting service left nearly 5,000 records open, including 884 stored in plain text passwords.

UpGuard says it assessed table structures rather than downloading full datasets, and that it notified affected organizations where contact information could be identified.

Why the databases were open

The exposures trace back to Postgres row-level security, or RLS, a database feature that restricts which rows a user can read or write. Supabase turns RLS on automatically for tables created through its own visual table editor, but tables generated through raw SQL, migration scripts or API calls do not get that protection by default, according to Supabase's own documentation. That second path is how AI coding assistants typically build a database schema when a developer describes an app in a prompt, meaning the default many vibe-coded projects inherit is the less protected one.

The pattern is not new. In May 2025, independent researcher Matt Palmer disclosed CVE-2025-48757, a critical-severity flaw affecting applications built with the AI app-builder Lovable on top of Supabase, after finding roughly 170 of 1,645 scanned Lovable projects had databases open to unauthenticated read or write access. That vulnerability was later logged in the National Institute of Standards and Technology's National Vulnerability Database. A separate incident in February 2026 exposed roughly 35,000 email addresses and 1.5 million authentication tokens tied to Moltbook, an AI-agent social network, again through an unsecured Supabase backend. UpGuard's new report suggests the underlying pattern has persisted across a much larger share of the platform's user base.

Supabase's response

Bil Harmer, Supabase's chief information security officer, told TechCrunch the company had not yet reviewed UpGuard's specific findings but said Supabase projects are "secure by default" and that responsibility for configuration is shared with customers.

"We provide secure defaults and tooling, and customers control how their own projects are configured," Harmer said, adding that Supabase notifies customers when it identifies security issues and continues working to make secure deployment easier.

Security researchers who reviewed the findings argue that a default protection that applies only to one specific workflow — the table editor — functions less as a safety net and more as a gap for anyone building through code generation, migrations or API calls, which is how most AI coding tools operate.

Who is affected

Supabase, which was valued at roughly $10 billion earlier in 2026, has become a default backend recommendation for a number of popular AI coding tools, and the company has said its own product is among the most frequently invoked by AI coding agents. That makes the exposure relevant less to a single company than to the wider ecosystem of hobbyist and early-stage commercial apps built quickly with AI assistance, where developers may not have database security experience and where generated code often skips the manual step of writing row-level policies. End users of those apps — customers of the valet service, immigration clients, consulate registrants — had no way to know their data sat behind an unlocked database.

What happens next

UpGuard's recommended fix is narrow but consequential: enable row-level security on every table and write policies that scope access to the correct user, a change researchers describe as a small amount of code with an outsized effect on exposure. Whether that guidance reaches the developers most likely to skip it is a separate question, since many of the affected projects were built quickly, often by people without a security background, and put into production without a review step.

Supabase says it is continuing to refine its defaults and tooling. UpGuard, for its part, says it plans further scans to track whether the exposure count falls once the report becomes public. Until enforcement moves from the API layer, where a request should have been blocked, back to the row of the database, where the request is instead evaluated, security researchers say the same pattern is likely to keep resurfacing across other AI-generated applications built on the platform.