UpGuard

[digital swipe] Supabase misconfigurations expose more than sixteen thousand databases.

UpGuard researchers found 16,326 Supabase databases with readable tables, pointing to a widespread configuration problem rather than a breach of Supabase itself.

Their schema-level review found indicators of personal information in more than half of the exposed databases.

Smaller numbers appeared to contain passwords or authentication tokens, and a few showed signs of possible payment card data.

UpGuard says the exposures span the globe and have grown alongside rapid app development, including projects built with AI coding tools.

The researchers validated a sample of the findings and notified app owners when they confirmed significant exposure.

[digital swipe] RatHat uses Gemini to find valuable victims.

Supabase misconfigurations expose more than 16,000 databases.

UpGuard researchers found 16,326 Supabase databases with readable tables, pointing to a widespread configuration problem rather than a breach of Supabase itself.

Their schema-level review found indicators of personal information in more than half of the exposed databases, Smaller numbers appear to contain passwords or authentication tokens, and a few showed signs of possible payment card data.

UpGuard says the exposures span the globe and have grown alongside rapid app development, including projects built with AI coding tools.

The researchers validated a sample of the findings and notified app owners when they confirmed significant exposure.

Yeah.

And we have different Tesla workers that are resisting training Optimus robots to replace them, according to some allegations.

And a story about UpGuard that found that 16,000 Supabase databases are leaking personal data to the open web.

All of that and more on the podcast today.

Before we get into the show, I wanted to mention if you've ever wanted to use all of the different AI models in one place, I'd love for you to check out my startup, which is called AIbox.ai. We give you access to over 90 different AI models in one playground.

They're going to have them in businesses.

It is definitely a wild time for technology.

Okay, UpGuard right now has found that there is 16,000 Supabase databases right now that are leaking personal data to the open web.

I didn't want to like do this segment like is like a fear and doom thing.

It's been fixed since Thursday to upgrade OpenCode on every developer machine.

Four, UpGuard looked at about 300,000 sites built on Supabase and found more than 16,000 databases with tables anyone on the internet could read, over half of them holding personal data and some holding passwords and login tokens.

Tables made in Supabase's dashboard get low-level security by default, but tables created through the API, which is how coding agents create them, don't.

Turn on row-level security for every Supabase table, including the ones an agent made.

It's really a story about a lock that only fits one door.

Researchers at UpGuard scanned roughly three hundred thousand domains built on Supabase, the database platform behind a large share of today's AI-assisted app building.

They found that many of the exposed tables were leaking real personal data, names, tokens, and in a Canadian Immigration Services case, eight hundred and eighty-four plain-text passwords.

The telling detail isn't that developers made mistakes.

And also, whose default is it anyway? Vendors are right to say a default can't cover every configuration choice a developer might make.

But this default fails on the single most common path in 2026: code that a person never directly wrote.

UpGuard's own framing is the sharpest part of its report.

It argues it's time to rebalance the equation, the way Amazon did with S3, which flipped to private-by-default buckets after a decade of leaks, and the way GitHub did with new repositories.

And we have different Tesla workers that are resisting training Optimus robots to replace them, according to some allegations.

And a story about UpGuard that found that 16,000 Supabase databases are leaking personal data to the open web.

All of that and more on the podcast today.

Before we get into the show, I wanted to mention if you've ever wanted to use all of the different AI models in one place, I'd love for you to check out my startup, which is called AIbox.ai. We give you access to over 90 different AI models in one playground.

They're going to have them in businesses.

It is definitely a wild time for technology.

Okay, UpGuard right now has found that there is 16,000 Supabase databases right now that are leaking personal data to the open web.

I didn't want to, like, do this segment, like, as, like, a fear and doom thing.

And I think there's a great irony in that statement because it doesn't specify which millions you're scaling to.

But the big news here is that new research coming out of a cybersecurity firm, UpGuard, has found that around 16,000 databases that are hosted by Superbase exposed some degree of personal data to the public web.

So scale to millions, but not the millions that you actually want using your technology or accessing your data.

So this, and I don't know if leak is even the right word, it's basically poorly constructed, five coded databases without the right security protocols in place.

And I think there's a great irony in that statement because it doesn't specify which millions you're scaling to.

But the big news here is that new research coming out of a cybersecurity firm, UpGuard, has found that around 16,000 databases that are hosted by Superbase exposed some degree of personal data to the public web.

So scale to millions, but not the millions that you actually want using your technology or accessing your data.

So this, and I don't know if leak is even the right word, it's basically poorly constructed, five coded databases without the right security protocols in place.