Security researchers at UpGuard found 16,326 app databases whose tables anyone on the internet could read, and over half showed signs of holding personal data. Most were built on Supabase, a database service that AI coding tools use constantly. If an app, portal or booking system was built for you quickly with AI tools in the last two years, it is worth a ten-minute check.
This is not a story about hackers breaking in. Nobody had to break anything. The doors were simply left open.
What happened
UpGuard looked at roughly 300,000 websites showing signs of using Supabase, then checked whether their databases would hand over data to anyone who asked. 16,326 did.
According to UpGuard’s report:
- More than half of those databases had indicators of personal information.
- A smaller share held passwords or login tokens.
- A very small number had what looked like card data.
The examples they published are ordinary small businesses, not tech giants. A US valet service’s customer system exposed over 100,000 customers, including names, emails and around 78,000 licence plates. A Canadian relocation coaching service exposed nearly 5,000 records, including 884 passwords stored in plain text. UpGuard says it notified owners where it found a significant exposure, and it did not report evidence of anyone misusing the data.
Why AI-built apps are hit hardest
Supabase protects a table with a setting called row level security. When you create a table by hand in its dashboard, that protection is switched on for you. When a table is created through code, which is how AI coding tools work, it is not switched on unless someone remembers to do it. The app works perfectly either way, which is exactly why nobody notices.
Supabase’s position, in coverage of the report, is that its defaults are secure and that how each project is configured is up to the customer. That is technically fair, and no comfort if it’s your customers’ data.
What it means for your business
If your app holds customer names, emails, phone numbers, bookings or anything with a password, and it was built quickly with tools like Lovable, Bolt, Replit or Cursor, or by a freelancer who used them, you should assume nobody has checked this until someone does.
The app working is not evidence. An open database works perfectly. It just works for everyone.
How to check, in plain English
- Ask whoever built it two questions: “Is the app’s data on Supabase (or Firebase)?” and “Is row level security switched on for every table, and do the rules actually limit who sees what?” A confident yes with a reason is a good sign. “I think so” is not.
- If you have access to the Supabase dashboard, open the Security Advisor. It flags tables without row level security. Any warning there on a table holding customer data is the thing to fix first.
- Check how passwords are stored. If you can see a customer’s actual password anywhere, in the database, an export or an admin screen, that needs fixing whatever else is true.
- Have someone test it from the outside. The researchers needed nothing but a web browser and the public details every app ships with. Testing the same way tells you what a stranger can see.
If it turns out to be open
Fix first, then think about what happened. Switching on the right protection is usually quick. Working out whether anyone read the data while it was open is slower, and depending on where your customers are, you may have legal duties to tell them or a regulator. Get proper advice on that part rather than guessing.
Then change any password or key that was stored where it could be read.
How to not be here again
AI tools are genuinely good at building apps fast, and we use them ourselves. What they do not do is ask the boring questions a careful developer asks: who should see this table, what happens if someone who isn’t logged in asks for it, where do the passwords live.
The fix is not to stop using them. It is to have a person who knows what to look for review anything that holds customer data before it goes live, and to look again whenever it changes.
If you want that person to be us, a first look is free and takes about half an hour. If everything is locked down properly, we’ll tell you that too.
Related reading: From idea to MVP in 90 days covers building an app properly at speed. How to choose the right AI development partner has the questions to ask before you hire anyone. And what it really costs to build a mobile app is the honest version of the budget.
Source: UpGuard, “Everything Everywhere: Systemic Data Exposure in Supabase Apps” · coverage: Unite.AI, Start With Identity.
Find this useful? Add us as a preferred source on Google and our posts will surface more often for you.
Changes only what you see in Google. Nothing is shared with us.
