Some Supabase customers are publicly exposing reams of people’s data to the web

A security investigation has revealed that numerous Supabase customers are inadvertently exposing sensitive personal data through publicly accessible databases. The findings underscore critical vulnerabilities in how developers configure backend infrastructure, particularly as AI-generated and rapidly-developed applications proliferate across the industry. Supabase, a popular open-source Firebase alternative, provides database services that require proper security configuration—a step many developers overlook or misunderstand.

The exposed data includes personal information such as email addresses, usernames, authentication tokens, and other sensitive user records stored in Supabase PostgreSQL databases. Security researchers discovered that these databases were left with public access permissions, allowing anyone on the internet to query and retrieve information without authentication. The issue stems primarily from improper Row Level Security (RLS) policies and incorrect permission settings during database setup. While Supabase itself provides security features, the responsibility falls on developers to implement them correctly. The problem has intensified with the rise of AI-assisted coding tools and rapid application development frameworks, where developers prioritize speed over security configuration.

• Configuration Responsibility: Developers must understand that platform-as-a-service providers offer security tools, but implementation remains the developer's responsibility
• AI Development Risks: Generative AI coding assistants may produce functional code without security best practices, creating a new class of vulnerabilities
• Data Privacy Compliance: Exposed personal information creates potential violations of GDPR, CCPA, and other data protection regulations
• Increased Attack Surface: Publicly accessible databases become prime targets for malicious actors seeking to harvest and exploit personal data
• Documentation and Education Needs: Development platforms must improve guidance on secure configuration during onboarding

These security exposures highlight a critical gap between building speed and security robustness in modern application development. As companies increasingly adopt AI tools to accelerate development cycles, ensuring that security configuration receives equal attention becomes essential. This incident serves as a reminder that infrastructure security requires deliberate implementation and continuous vigilance, regardless of how quickly applications reach production.