[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNw4IfLrCe8-9hnbw7bTC-KUjNJ6Kq8dpU6GzueLBtP8":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"dc8f4a89-9904-459c-a619-61cc47577efc","Misconfigured Supabase apps expose data in over 16,000 databases","misconfigured-supabase-apps-expose-data-in-over-16-000-databases-660620","Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. [...]","Researchers discovered that more than 16,000 Supabase databases were misconfigured, leading to the exposure of sensitive data including PII, passwords, and authentication tokens. While a small portion may include credit card data, the primary cause is attributed to poor application security configurations, such as missing row-level security policies, with a notable trend of AI-assisted development contributing to these issues.","Over 16,000 Supabase databases exposed PII, passwords, and auth tokens due to misconfigurations.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmisconfigured-supabase-apps-expose-data-in-over-16-000-databases\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F29\u002FDataLeak.jpg","2026-09-28T18:50:59+00:00","2026-09-28T20:00:19.263501+00:00",7,[17,20,23,25],{"name":18,"type":19},"Supabase","product",{"name":21,"type":22},"PostgreSQL","technology",{"name":24,"type":22},"artificial intelligence",{"name":26,"type":27},"UpGuard","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[26,18],{"controls":54,"vendors":138},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":85,"name":86,"problem":87,"products":88},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":40,"name":114,"problem":115,"products":116},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":134,"product_name":135,"url":136,"description":137},"boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",[139],{"slug":140,"name":26,"logo_path":141,"roles":142},"upguard","\u002Fvendor-logos\u002Fupguard.png",[143],"reported_by",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":160},"16000-supabase-databases-exposed-due-to-misconfiguration","16,000+ Supabase Databases Exposed Due to Misconfiguration","Over 16,000 Supabase databases were left exposed due to missing or improperly configured row-level security (RLS) policies, allowing unauthorized access to sensitive data including PII, passwords, and authentication tokens. The root cause lies in developers — particularly those leveraging AI-assisted development tools — deploying databases without fully understanding or implementing proper security configurations. This highlights a growing risk where the speed of AI-generated code outpaces security best practices, resulting in production systems that are functionally complete but dangerously exposed. The exposure of authentication tokens and credentials compounds the risk, as attackers can pivot from data theft to full account takeover. This incident underscores that cloud-native platforms still require deliberate security hardening regardless of how the application was built.",[149,150,151,152,153,154,155,156,157,158,159],"CIS Control 3: Data Protection","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SI-10: Information Input Validation","NIST CSF PR.AC-4: Access Permissions and Authorizations","OWASP Top 10 A05:2021 – Security Misconfiguration","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","NIST SP 800-218 SSDF PW.6: Configure the Software to Have Secure Settings by Default",{}]