Supabase databases expose sensitive user data due to misconfigurations, UpGuard research finds

Thousands of Databases Exposed

Cybersecurity firm UpGuard has identified approximately 16,000 databases hosted by development platform Supabase that are publicly exposing sensitive personal information. This includes data such as names, addresses, phone numbers, and user passwords. The research indicates that while some passwords and authentication tokens were found, the primary concern is the broad exposure of personal identifiers.

Developer Misconfigurations as Root Cause

The exposure is attributed to misconfigurations by developers using the Supabase platform. The ease of building applications, sometimes with AI tools, can lead to security flaws in generated code or a lack of understanding regarding necessary security configurations. This issue is not unique to Supabase, as improperly configured storage servers and databases have historically led to numerous data breaches.

Supabase's Security Challenges

Supabase, which recently achieved a $10 billion valuation, has faced criticism regarding its approach to user security. There are documented instances of users unknowingly exposing their databases to the internet, sometimes involving millions of records. The platform allows developers to store and run their databases, and the current findings underscore ongoing challenges in ensuring data privacy and security for its users.

Examples of Exposed Data

UpGuard's research uncovered various types of sensitive data across different projects. Examples include private conversations from an Indian adult streaming site, thousands of license plates from a U.S. valet service, and contact information from an immigration and relocation service. One database belonged to an African government's consulate in France, and another was linked to a virtual SIM farm used for intercepting text messages for one-time passcodes, often associated with scams and phishing.