More than 16,000 misconfigured Supabase databases reportedly expose sensitive data

Readable tables found in a survey of about 300,000 domains

UpGuard researchers reportedly examined roughly 300,000 domains showing signs of Supabase use and looked for accessible database tables. They reported finding more than 16,000 misconfigured databases with readable tables. Based on table schemas, they said more than half contained personally identifiable information, with passwords and authentication tokens in smaller subsets. The researchers attributed the exposure to application-security configuration problems, including missing or ineffective row-level security policies and misuse of public keys.

The available report does not provide a comparable earlier count of exposed Supabase databases.

Researchers reportedly identified more than 16,000 misconfigured Supabase databases with readable tables. More than half of the exposed databases reportedly contained personally identifiable information, while smaller subsets included passwords or authentication tokens.

The reported finding concerns a large set of databases used by apps and websites, with the accessible tables said to include data that can identify users and, in some cases, credentials or authentication material.