Company
Cybersecurity company offering third-party risk and attack-surface monitoring tools, whose research team frequently uncovers exposed cloud databases.
UpGuard found 16,326 Supabase databases with readable tables in a scan of roughly 300,000 domains. Supabase's new default keeps new tables off its APIs, but older tables keep their grants until owners review them and their row-level security.
Reality
Supabase raised $150 million and agreed to buy Turso, whose SQLite-compatible engine gives AI agents large numbers of small, isolated databases. The deal rests on Supabase's own count of agent-created databases, and Turso's customers now build on that bet.
Perspective Coverage
8 publishersReality
Ninety-eight of 100 public Supabase migration histories leave a table the Data API cannot reach once automatic grants end on Oct 30, a dev.to replay found. Existing tables keep their grants, so the failures land on new tables and on environments rebuilt from those files.
Reality
UpGuard found more than 16,000 Supabase databases exposing readable tables of personal data, passwords and authentication tokens. It blames row-level security and key settings that each project's owner controls, so every app needs its own fix.
Reality
Block Public Access stops anonymous reads. It does nothing about the naming scheme an attacker has already rebuilt from your public TLS certificates, and that reconstruction leaves no log behind.
Reality