Custom-built applications, forms, and online stores rely on a customer database—which, without the proper access rules, can be viewed by anyone on the internet.
Many small businesses have an app, an appointment scheduling form, or an online store built by a freelancer, an agency, or—increasingly—with the help of an AI coding assistant. Behind them lies a database where customer data is stored, and that database can remain open without the owner’s knowledge.
Researchers at UpGuard found more than 16,000 Supabase databases—a platform commonly used for such applications—with tables that anyone could read without a password. More than half of them contained personal data; some contained passwords and access tokens; in one case, there were over 100,000 customer records.
The issue isn't a sophisticated attack, but a missing setting. "Row-Level Security" is the rule that determines who is allowed to read each row in the database; when it isn't enabled, the tables remain open to anyone who knows the address. Over 60% of these databases had been created using AI-powered programming tools, and the owners didn’t even know how they were configured.
For a small business, this means that customer data may be visible on the internet, and such exposure constitutes a data breach subject to reporting requirements under the GDPR.
What you need to do:
- Make a list of the apps, forms, and online stores created for your company, and note who built them.
- Ask the person who maintains them in writing to confirm that the database access rules are active and that customer data cannot be publicly accessed.
- If you use a platform like Supabase, check the security indicators in the dashboard and enable “Row-Level Security.”
- If you cannot obtain confirmation, treat the situation as a potential data breach and request an audit.
A cheap app isn't cheap anymore if it leaves your customers exposed. Often, all it takes is a clear question for the person who built it and a written confirmation.
This article was generated with AI assistance.