UpGuard finds about 16,000 Supabase databases exposed user data amid AI vibe-coding boom

Cybersecurity firm UpGuard said it found around 16,000 databases hosted on Supabase exposing some degree of personal data to the public web, including names, addresses, phone numbers, user passwords and authentication tokens. The findings link the exposures to misconfigurations tied to the surge in AI vibe-coding apps.

The exposed data spanned various projects, such as private conversations with sex workers on an Indian adult streaming site, thousands of license plates belonging to a U.S. valet service, and contact information for users of an immigration and relocation service. UpGuard also identified a database belonging to an African government's consulate in France, and another linked to a virtual SIM farm used to intercept text messages for one-time passcodes, typically for scams and phishing attacks.

While most exposed datasets appear to be in the United States, UpGuard described the issue as worldwide. Vibe-coded apps and websites can spill sensitive data through basic misconfigurations, and AI-generated code may contain security flaws or require configurations developers are unaware of. Supabase, which reached a $10 billion valuation earlier in 2026 amid a rise in developers hosting vibe-coded apps, has faced criticism over its security handling.

Supabase CISO Bil Harmer said the company had not seen the research but described projects as “secure by default,” calling security a shared responsibility. The company provides secure defaults and tooling, notifies affected customers when issues are found, and “security at Supabase is never finished,” he said. UpGuard security researcher Greg Pollock said the research was important for raising awareness of data exposure issues.