Cybersecurity research by UpGuard has revealed that thousands of databases hosted on Supabase, a popular development platform for web and app hosting, are publicly exposing sensitive personal data. Approximately 16,000 databases were found to contain exposed information, including names, phone numbers, addresses, and some passwords. Supabase, which recently achieved a $10 billion valuation, enables developers to store and manage data but has faced criticism for security issues associated with misconfigured user projects.

The exposed data spans various projects worldwide, with sensitive materials ranging from private conversations on adult streaming sites to U.S. valet service license plates and contact details for immigration services. Some databases belonged to governmental entities like an African consulate in France, while others were linked to fraudulent activities such as virtual SIM farms used for intercepting text messages and conducting scams. Most of these incidents have roots in basic configuration errors or misunderstandings by developers, often compounded by the automatic code generation prevalent with AI-driven vibe-coded apps.

This troubling trend underscores the security risks inherent in the rapid adoption of AI-generated code and platform-as-a-service tools. Developers frequently lack the expertise to properly secure databases, leading to accidental data leaks. Supabase has reportedly improved its security features over time and emphasizes a shared responsibility model, where the company provides secure defaults and tools, but customers are responsible for their project configurations. The company's Chief Information Security Officer, Bil Harmer, pointed out that security is an ongoing challenge and they continuously work to enhance protections.

UpGuard’s findings add to a growing list of data breaches linked to poorly configured digital infrastructure, which have previously exposed government and military information, immigration data, and personal details of children. As AI-powered app development grows, the frequency and scale of such breaches may increase unless developers become better equipped to manage security. Researchers like UpGuard advocate for raising awareness about these exposures to prompt more rigorous security hygiene in the developer community.