UpGuard: 16,326 Supabase Databases Exposing Data
The largest study of Supabase misconfigurations: thousands of app databases readable by anyone.
.png)
About UpGuard: 16,326 Supabase Databases Exposing Data
UpGuard Research found 16,326 Supabase databases readable without authentication, more than half showing personal information, from apps built all over the world. Published 25 September 2026, it is the largest study of its kind.
Why it matters for builders: Supabase is the default backend for vibe-coded apps, and tables created through SQL, migrations or the API do not get row-level security switched on. The agent scaffolds the table; nobody writes the policy. The anon key then reads everything.
Read the study, then query every table in your project with the anon key before you share a link. Our companion checklist walks through the fix.
The facts
- Type
- Guides
- Tags
- Developer ToolsSaaS
- Listed
- September 28, 2026
More Guides
See all →- Don't Write Markdown Files for Your Coding Agent. Write ScriptsRules in AGENTS.md are suggestions. A script with a pass or fail result is a constraint.
- An Agent Said It Deployed. The Containers Were a Day OldFour claims an agent makes about a deploy, and the command that proves each one.
- Jev + Opus: Frontier-Accuracy LLM Judging at 4x Lower CostHightouch's test: a Jev plus Opus hybrid judge matched frontier accuracy at over 4x lower cost.
- Agent Skills Drift: A Feedback Loop for Keeping One TrueAgent skills go stale in six ways while their checks stay green. A step-by-step loop to catch it.
- Four Ways a Test Can Lie to YouWhat 530 agent-written tests taught one developer: checks can be green, or red, and mean nothing.