--- title: 16,000 Supabase databases leak data, Aurora DSQL finally... description: UpGuard found over 16,000 exposed Supabase databases with plaintext passwords and auth tokens, many traced back to AI-generated apps whose developers never... canonical: https://daily.dev/posts/16-000-supabase-databases-leak-data-aurora-dsql-finally-gets-foreign-keys-2pyyaondx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 16,000 Supabase databases leak data, Aurora DSQL finally gets foreign keys | daily.dev og:description: UpGuard found over 16,000 exposed Supabase databases with plaintext passwords and auth tokens, many traced back to AI-generated apps whose developers never... og:url: https://daily.dev/posts/16-000-supabase-databases-leak-data-aurora-dsql-finally-gets-foreign-keys-2pyyaondx og:image: https://api.daily.dev/og/posts/2PyyaOnDX.png og:image:alt: 16,000 Supabase databases leak data, Aurora DSQL finally gets foreign keys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 16,000 Supabase databases leak data, Aurora DSQL finally gets foreign keys **[Databases Digest](https://daily.dev/sources/databases_digest)** · 5 min read · 2 upvotes · 0 comments ## Summary UpGuard found over 16,000 exposed Supabase databases with plaintext passwords and auth tokens, many traced back to AI-generated apps whose developers never touched row-level security. Aurora DSQL shipped foreign key constraints, closing the biggest adoption gap since its 2024 launch. Databricks pushed Lakebase Search into GA claiming big wins over pgvector, and a MySQL upgrade postmortem lays out exactly why your queries get slower after a major version bump even when nothing else changed. ## Content **TLDR:** UpGuard found over 16,000 exposed Supabase databases with plaintext passwords and auth tokens, many traced back to AI-generated apps whose developers never touched row-level security. Aurora DSQL shipped foreign key constraints, closing the biggest adoption gap since its 2024 launch. Databricks pushed Lakebase Search into GA claiming big wins over pgvector, and a MySQL upgrade postmortem lays out exactly why your queries get slower after a major version bump even when nothing else changed. --- ## 16,000+ Supabase databases exposed publicly, many traced to AI-generated apps UpGuard scanned roughly 300,000 domains running Supabase and found more than 16,000 databases with tables readable by anyone, no authentication required. The exposed data includes names, addresses, plaintext passwords, auth tokens, and some credit card numbers, with specific cases ranging from a U.S. valet service (100,000+ records) to a Canadian immigration service with 884 plaintext passwords sitting in the open. The root causes are boring and familiar: missing row-level security policies and misused public API keys, but UpGuard notes a pattern connecting many of these deployments to AI-coding-agent-generated apps where the developer shipped working code without understanding the database security model underneath it. Supabase, valued at $10B partly on the vibe-coding wave, says its defaults are secure and security is shared responsibility, which is technically true and also not very comforting if you're one of the exposed 16,000. [Read more](https://daily.dev/posts/l5fvS1MIv) ## Aurora DSQL adds foreign key constraints AWS shipped foreign key support for Aurora DSQL, including CASCADE and SET NULL, addressing what users have called the biggest blocker to adoption since the database launched at re:Invent 2024. Referential integrity is enforced via snapshot verification and commit-time conflict detection rather than table locking, so conflicting transactions fail with a serialization error instead of blocking, meaning your app needs retry logic. AWS is upfront that all DML on referenced or referencing tables now costs extra reads, and recommends benchmarking before rolling constraints out on distributed workloads. [Read more](https://daily.dev/posts/d6sam6ouw) ## Databricks ships Lakebase Search, claims 2x throughput over pgvector Databricks announced GA for Lakebase Search, two new Postgres extensions: lakebase_vector for ANN search and lakebase_text for BM25 full-text scoring. The pitch against pgvector is specific: HNSW indexes need to fit entirely in RAM for speed, which means builds that can take up to 50 hours and REINDEX operations that lock the table. Lakebase separates storage from compute instead, using quantized vectors for hot data and block reads from object storage for cold data, claiming 2x throughput and 4x cost savings on VectorDBBench's 100M-vector benchmark at 71ms P99 and 97% recall. Worth a real evaluation if you're hitting pgvector's RAM ceiling, though the numbers come from Databricks' own benchmark. [Read more](https://daily.dev/posts/gAfr152Pe) ## MySQL query plans regress after engine upgrades — here's the actual diagnostic playbook A workflow for the exact scenario every DBA dreads: queries get slower after a major MySQL upgrade on Aurora or RDS, with zero application or schema changes. Three root causes account for most of it — optimizer flag defaults changing between versions (prefer_ordering_index in 8.0.27, hash join expansion in 8.0.18/8.0.20, subquery_to_derived in 8.0.22), collation mismatches in mixed environments, and a cold buffer pool after restart masquerading as a real regression. The fix path is refresh stats first, diff EXPLAIN ANALYZE before/after to find the regression signature, then match the signature to its specific version trigger. If you're planning an upgrade, capture EXPLAIN baselines first and use Blue/Green Deployments — this is the kind of thing that's much cheaper to prevent than diagnose after the fact. [Read more](https://daily.dev/posts/7OLIv3023) --- ## Also notable - **PostgreSQL 19's WAIT FOR LSN cuts standby CPU nearly in half under load:** Under ten concurrent workers, the new WAIT FOR LSN command drops mean standby CPU from 57% to 38% versus a busy-poll loop while increasing throughput, because it parks the backend instead of spinning it. [Read more](https://daily.dev/posts/Z49jlpMTA) - **Neon's branch-based restores make recovery time independent of database size:** Lakebase's architecture turns Postgres restores into a metadata operation instead of a data copy, with restore time flat even at 100TB, against a backdrop where a cited survey found 59% of developers had a critical production failure in the past year and only 21% recovered in under 60 minutes. [Read more](https://daily.dev/posts/udhwx0m8Z) - **Meta's ZGateway handles 1B+ ops/sec while cutting ZippyDB connections 19x:** The stateless proxy layer centralizes auth, admission control, and shard resolution for over a million client hosts, cutting per-host connection counts by 97-98% while carrying roughly 40% of ZippyDB's total traffic. [Read more](https://daily.dev/posts/v79Y7ZRIQ) - **pt-online-schema-change's adaptive chunk resizing can stall a Galera cluster:** When matching rows for a --where clause cluster at the end of an index, pt-osc's chunk auto-resize can balloon transaction size and trigger severe Galera Flow Control, causing a real production cluster stall that required a restart — disable adaptive resizing with --chunk-time=0 if you're running selective pt-osc on PXC. [Read more](https://daily.dev/posts/yq3a6qX05) - **Updating Postgres with pg_squeeze now requires an extra config step:** A new output_plugin_libraries parameter in recent PostgreSQL point releases means pg_squeeze users must explicitly add 'pg_squeeze' to it during upgrades or squeezing will fail with an output-plugin registration error. [Read more](https://daily.dev/posts/9X8G0qIxm) --- Tags: [#security](https://daily.dev/tags/security), [#postgresql](https://daily.dev/tags/postgresql), [#mysql](https://daily.dev/tags/mysql), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/16-000-supabase-databases-leak-data-aurora-dsql-finally-gets-foreign-keys-2pyyaondx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/16-000-supabase-databases-leak-data-aurora-dsql-finally-gets-foreign-keys-2pyyaondx","headline":"16,000 Supabase databases leak data, Aurora DSQL finally gets foreign keys","text":"UpGuard found over 16,000 exposed Supabase databases with plaintext passwords and auth tokens, many traced back to AI-generated apps whose developers never touched row-level security. Aurora DSQL shipped foreign key constraints, closing the biggest adoption gap since its 2024 launch. Databricks pushed Lakebase Search into GA claiming big wins over pgvector, and a MySQL upgrade postmortem lays out exactly why your queries get slower after a major version bump even when nothing else changed.","url":"https://daily.dev/posts/16-000-supabase-databases-leak-data-aurora-dsql-finally-gets-foreign-keys-2pyyaondx","datePublished":"2026-09-29T04:17:39.211Z","dateModified":"2026-09-29T04:18:02.571Z","author":{"@type":"Organization","name":"Databases Digest","logo":"https://media.daily.dev/image/upload/s--ir1hdV8b--/f_auto,q_auto/v1773839400/logos/databases_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/databases_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/databases_digest","name":"Databases Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Databases Digest","item":"https://daily.dev/sources/databases_digest"},{"@type":"ListItem","position":3,"name":"16,000 Supabase databases leak data, Aurora DSQL finally gets foreign keys"}]} ```