Security1 hOctober 8, 2026, 12:20

UpGuard: 16,326 Supabase Databases Were Publicly Readable Due to Disabled RLS

UpGuard found 16,326 Supabase projects with publicly readable tables, and more than half showed signs of personal data, including passwords and tokens. The cause was disabled row-level security, not a breach: the anon key shipped in client code could read the tables.

DEV Community

Open source

UpGuard: 16,326 Supabase Databases Were Publicly Readable Due to Disabled RLS

16,326 Supabase databases had publicly readable tables
More than half showed signs of personal data, some with passwords and tokens
Cause was disabled Row-Level Security, not a hack
UpGuard says many apps appear built with AI coding agents

#Supabase#UpGuard

UpGuard: 16,000 Supabase databases publicly expose user data

Business

Supabase raises $150M and acquires database startup Turso

Security

Scan finds working service_role key in git for 58 of 154 public Supabase apps

Security

UpGuard: 16,326 Supabase Databases Were Publicly Readable Due to Disabled RLS

UpGuard: 16,000 Supabase databases publicly expose user data

Supabase raises $150M and acquires database startup Turso

Scan finds working service_role key in git for 58 of 154 public Supabase apps

DHS HART Biometric Database Holds 260 Million People Without Public Rules