Кибер аюулгүй байдлын UpGuard компанийн судалгаагаар хөгжүүлэлтийн Supabase платформ дээр байршуулсан олон мянган мэдээллийн сангийн нууцлал алдагдсан болохыг тогтоов
UpGuard компанийн мэдээлснээр, хөгжүүлэгчид өөрсдийн вэб болон аппликейшний мэдээллийн санг хадгалах, ажиллуулахад ашигладаг Supabase платформын 16,000 орчим сан нь нийтэд ил тод, хамгаалалтгүй байгааг илрүүлжээ. Эдгээр санд хэрэглэгчдийн нэр, хаяг, утасны дугаар, нууц үг зэрэг хувийн шинжтэй мэдээллүүд хадгалагдаж байсан байна.
Уг асуудал нь хиймэл оюун ухаан ашиглан хурдацтай хөгжүүлж буй программ хангамжуудын тохиргооны алдаа болон аюулгүй байдлын сул талтай холбоотой гэж мэргэжилтнүүд үзэж байна. Илэрсэн мэдээллийн сангууд дотор насанд хүрэгчдийн стриминг үйлчилгээний хувийн яриа, АНУ-ын автомашины үйлчилгээний байгууллагын лицензийн дугаар, цагаачлалын үйлчилгээний холбоо барих мэдээлэл болон Африкийн засгийн газрын дипломат төлөөлөгчийн газрын өгөгдлүүд багтаж байгаа аж.
Supabase-ийн Мэдээллийн аюулгүй байдлын ахлах ажилтан Бил Хармерын тайлбарласнаар, тус компани нь аюулгүй байдлын үндсэн тохиргоог хангаж ажилладаг бөгөөд аюулгүй байдал нь компани болон хэрэглэгчийн хамтын хариуцлага гэдгийг онцолжээ. Хэдийгээр тус платформ нь аюулгүй байдлаа бэхжүүлэх тал дээр тасралтгүй сайжруулалт хийж байгаа боловч хөгжүүлэгчдийн буруу тохиргооноос үүдэн ийм төрлийн эрсдэлүүд үүссээр байгаа нь салбарын хэмжээнд анхаарал татах асуудал болоод байна.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
Thousands of databases hosted by development platform Supabase are exposing people’s sensitive information to the public web, new security research by cybersecurity firm UpGuard has found.
UpGuard told TechCrunch that it found around 16,000 databases on which some degree of personal data was exposed while they were hosted by Supabase, which allows web and app developers to store and run their databases.
Supabase earlier this year reached a $10 billion valuation, thanks to a rise in developers hosting their vibe-coded apps on the platform. But the company has faced criticism for how it handles user security. There are widely documented cases of users misconfiguring or unknowingly exposing their databases to the broader internet, in some instances to the tune of millions of records each.
The findings highlight how vibe-coded apps and websites can spill or expose sensitive data through basic misconfigurations and improper security. While AI tools can be used to easily build websites and apps, the generated code can often contain security flaws, or apps might require specific configuration that the developer may be ignorant of.
Over the years, countless data breaches have been linked to improperly configured storage servers, databases and websites. Such cases have resulted in the leaks of sensitive military emails, immigration and visa applications, classified government files, hundreds of thousands of driver’s license scans and children’s personal information.
Now, the boom in AI vibe-coding is helping fuel a new wave of data breaches, many of which are now being linked to Supabase as people increasingly use it for storing their data.
UpGuard says it sought to understand the scale of exposed data across the platform, and found publicly accessible names, addresses, phone numbers and user passwords. The research surfaced a fewer number of passwords and authentication tokens.
The firm said the databases contained data linked to various projects, such as private conversations with sex workers on an Indian adult streaming site; thousands of license plates of a U.S. valet service; and the contact information of people who used an immigration and relocation service. One of the databases belonged to an African government’s consulate in France, said UpGuard, while another was used to intercept text messages by a virtual SIM farm for sending one-time passcodes to verify online accounts, typically for launching scams and phishing attacks.
While the majority of these exposed datasets appear to be located in the United States, UpGuard said this is a worldwide problem. The findings build on earlier research that also found a range of exposed databases hosted on Supabase, including those by Y Combinator startups and other popular apps.
Supabase has made changes to its platform over the years, including bolstering its platform and user access to databases.
When reached for comment, Supabase’s Chief Information Security Officer Bil Harmer said that while the company has not seen the research, its projects are “secure by default.” He described security as a shared responsibility between the company and its customers. “We provide secure defaults and tooling, and customers control how their own projects are configured,” and the company notifies affected customers when security issues are discovered, he said.
“Security at Supabase is never finished. We care deeply about getting it right, and we’ll keep making it easier for every developer to ship securely,” said Harmer.
UpGuard security researcher Greg Pollock said the company’s research was important for raising awareness about the issue of data exposures.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
