UPGUARD has found that around 16,000 databases hosted on the Supabase development platform exposed some degree of personal data to the public internet. Supabase enables developers to store and run databases for websites and applications. The finding, reported by TechCrunch, concerns customer configurations that left data accessible online rather than an attack involving a vulnerability in Supabase itself.
The report follows previous documented cases in which Supabase users misconfigured APIs or unknowingly made databases publicly reachable. Some exposures reportedly involved millions of records, although the supplied article does not provide a breakdown of the affected organisations, the types of data involved or how many people were affected. It also does not state whether the newly identified databases were accessed or misused by attackers.
UpGuard’s findings therefore establish public exposure, not confirmed exploitation. The article provides no specific remediation steps beyond highlighting the configuration issue; affected Supabase customers would need to review database and API access settings and determine whether exposed information requires further action.