16,000 Supabase Databases Exposed Personal Data Without Authentication

UpGuard researchers found around 16,000 Supabase-hosted databases exposing names, addresses, phone numbers and passwords without authentication, reported Sept. 25, 2026. The backend platform, valued at $10 billion earlier in 2026, serves vibe-coded apps. Majority of exposures appear U.S.-based, though UpGuard called it worldwide.