UpGuard: 16,326 Supabase Databases Exposing Data
The largest study of Supabase misconfigurations: thousands of app databases readable by anyone.
.png)
About UpGuard: 16,326 Supabase Databases Exposing Data
UpGuard Research found 16,326 Supabase databases readable without authentication, more than half showing personal information, from apps built all over the world. Published 25 September 2026, it is the largest study of its kind.
Why it matters for builders: Supabase is the default backend for vibe-coded apps, and tables created through SQL, migrations or the API do not get row-level security switched on. The agent scaffolds the table; nobody writes the policy. The anon key then reads everything.
Read the study, then query every table in your project with the anon key before you share a link. Our companion checklist walks through the fix.
The facts
- Type
- Guides
- Tags
- Developer ToolsSaaS
- Listed
- September 28, 2026
More Guides
See all →- The September Cut Took 17% of My Claude Code Week. Subagents Took 48%455 sessions of logs show where a Claude Code week actually goes, and which saving tips work.
- Evidence-Driven Development: Give Your Coding Agent Something to ProveWrite a claim that can lose, break the app on purpose, and keep evidence your agent can't fake.
- Slopsquatting: Your AI Invented a Package, and an Attacker Was WaitingNearly 1 in 5 AI-suggested packages in one study did not exist. How attackers use that.
- Free the Models: Harness Design at the FrontierReplit stopped routing work for the model and let the model decide. Here are the numbers.
- AI Coding Made CI a Bottleneck, So Linear Reworked TheirsHow Linear cut PR wait time and halved runner cost while its test suite quadrupled.