Thousands of app databases are readable by anyone, UpGuard finds

A lot of new apps are built quickly, often with an AI coding assistant doing most of the work, on top of a hosted database service called Supabase. Security firm UpGuard looked at roughly 300,000 websites that use it and found 16,326 databases where at least some tables could be read by anyone who knew where to look. Over half showed signs of personal information. Here’s what the research found and what it means for the apps you sign up for.

What UpGuard found

In its report, UpGuard explains that Supabase databases are protected by rules that decide who can read each table, called row-level security. If those rules are missing or written badly, the public key that every Supabase app ships in its web pages is enough to read the data. Supabase now turns those rules on by default for tables made in its dashboard, but UpGuard notes that tables created through its API, which is how coding assistants usually do it, don’t get them by default.

UpGuard gathered about 300,000 domains with signs of Supabase and asked each one for a table of users. Of those, 16,326 databases returned readable tables. Based on the table structures:

• over half had indicators of personal information
• a smaller share included passwords or login tokens
• a very small number had plausible credit card data

To check that the data was real, UpGuard looked closely at a handful of cases and notified the owners where it found a significant exposure. One was a relocation and immigration coaching service for people moving to Canada. Of nearly 5,000 records in its users table, almost all had full names, email addresses, phone numbers and birth dates, and 884 had a password stored in plain text. Others included a U.S. valet service with more than 100,000 customers’ phone numbers and licence plates, and a consulate’s database of 25,000 people that listed which emergency housing location each person was living in.

UpGuard argues these sites are mostly built by AI coding agents whose owners don’t understand the database settings. Its study doesn’t prove that for each site, and UpGuard didn’t name the businesses.

What this means for you

You can’t tell from the outside whether a small app has its database locked down. What you can control is how much it gets, and whether one leak spills into the rest of your accounts. The Canadian example is a good warning: people sharing their birth date and immigration plans with a coaching service had no way to know their password was sitting in plain text.

What you can do

1. Use a different password for every service. Then a plain-text password leak from a small app gives away exactly one account. A password manager makes this painless.
2. Give new apps the minimum. If a sign-up form asks for a birth date or phone number it doesn’t obviously need, leave it out or ask why.
3. Be extra careful with apps that handle immigration, health or money. Prefer services that tell you who runs them and how to reach them about privacy.
4. If you build apps, check your tables. Make sure row-level security is enabled and actually restricts reads on every table, including ones your coding assistant created, and never store passwords in plain text.
5. Watch for messages that use details you gave a small app. See how scammers use leaked data.

How Frame helps

Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.

Sources

• UpGuard, Everything Everywhere: Systemic Data Exposure in Supabase Apps, October 14, 2026