Some Supabase Customers Are Publicly Exposing Large Amounts of User Data, Research Finds

Some customers using the Supabase platform are publicly exposing large amounts of user data to the web, according to findings reported by TechCrunch.

The research highlights how applications built using AI-generated code or through so-called vibe-coding practices can end up spilling and exposing users' data when they are not properly configured or secured, pointing to a broader risk tied to the rapid, AI-assisted development of applications.

A risk tied to configuration, not the platform itself

The exposures appear to stem from misconfiguration on the part of individual customers building applications on Supabase, rather than from a flaw in the platform itself, underscoring how easily security settings can be overlooked when apps are built quickly, including with the help of AI coding tools.

As AI-assisted and vibe-coded development has become more common, allowing developers, including those with less technical background, to build and deploy applications rapidly, concerns have grown about whether adequate attention is being paid to security fundamentals such as access controls and data permissions.

The findings serve as a reminder that speed of development does not eliminate the need for careful configuration of backend services, particularly when those services store sensitive user data.

It was not specified in the available reporting how many customers or how much data was affected, or whether Supabase has taken any steps in response to the findings.