The rapid rise of AI-assisted development is making it easier than ever to build websites and applications. But new security research suggests that speed and convenience can come with a serious cost when databases are not configured correctly.

Cybersecurity firm UpGuard has identified roughly 16,000 databases hosted on Supabase where some level of personal information was accessible from the public internet. The discovery highlights a growing concern for developers using AI tools and simplified development platforms: an application can appear functional while its underlying data infrastructure remains dangerously exposed.

The Risk Behind Faster Development

Supabase provides developers with database and backend infrastructure for building applications. Its growing popularity has coincided with the rise of AI-assisted and “vibe-coded” applications, where developers can use natural-language prompts and AI-generated code to create software with limited traditional programming experience.

However, generating an application is only one part of building a secure product.

Database permissions, authentication, API access, row-level security and other configuration settings still need to be reviewed carefully. If these controls are overlooked, information stored behind an application could potentially become accessible to unauthorized users.

UpGuard reported finding publicly accessible information including names, addresses, phone numbers and, in a smaller number of cases, passwords and authentication tokens.

What Was Found in the Exposed Data?

According to the research, the exposed databases were connected to a wide range of applications and organizations.

Some datasets reportedly contained private conversations, vehicle license plate information and contact details belonging to users of immigration and relocation services. UpGuard also identified a database associated with an African government consulate in France.

Another exposed system was reportedly connected to a virtual SIM operation used to intercept text messages containing one-time verification codes. Such information could potentially create significant security risks if accessed by malicious actors.

The examples demonstrate that database exposure is not limited to one industry or application type. Any organization storing personal or authentication-related information can face consequences if access controls are improperly configured.

AI Coding Makes Security Reviews More Important

AI-assisted development can dramatically reduce the technical barriers to creating software. However, generated code does not automatically guarantee secure architecture.

An AI tool may produce working application logic while leaving developers responsible for configuring permissions, authentication and database policies correctly. Developers who are unfamiliar with backend security can therefore unintentionally deploy applications with weaknesses that are difficult to notice from the user interface.

This creates an important distinction between building an application quickly and building an application securely.

Security testing needs to be part of the development process rather than something performed only after an application is launched.

A Shared Responsibility

Supabase has said that its platform is designed with secure defaults and that customers remain responsible for how their individual projects are configured. The company also said it notifies affected customers when security problems are identified.

This reflects a broader principle in cloud computing: platform providers can offer security controls and safer defaults, but organizations using those platforms still need to configure and monitor their environments properly.

The issue is therefore bigger than one platform. Similar database exposure incidents have affected cloud storage, websites and other online services for years.

What Developers Can Do

Organizations building AI-assisted applications should treat database security as a core development requirement.

Regular permission reviews, strong authentication, properly configured access policies, security testing and monitoring can help identify accidental exposure before sensitive information becomes publicly accessible.

Developers should also avoid assuming that an application is secure simply because the code was generated by a trusted AI tool or because the application is hosted on a major cloud platform.

The growing use of AI in software development is likely to continue. As development becomes faster and more accessible, security practices need to evolve alongside it.

The lesson from these database exposures is straightforward: AI can accelerate application development, but secure configuration, testing and responsible data management still require human oversight.