UpGuard: 16,326 Supabase databases are publicly readable due to missing RLS

UpGuard Research scanned about 300,000 domains using Supabase and found 16,326 databases with publicly readable tables; over half contained personal data, including passwords and auth tokens. The issue stems from tables created via API or migrations by coding agents, which do not enable RLS by default.

• 16,326 Supabase databases out of ~300,000 domains are publicly readable
• Over half contained personal data, some with passwords and tokens
• A US valet service exposed data on 100,000 customers
• From October 30, new tables will no longer be auto-exposed in the Data API