Supabase Leaks, What We Found
labs.cognisys.group | blog | #cloud-security | #pentesting | #account-takeover | #ssrf | #supabase | #baas
Summary
In late 2025 and early 2026, the cybersecurity landscape witnessed a disturbing trend involving the mass disclosure of Supabase API keys. This pattern came to a head when our team identified a massive leak involving a client who approached us for a Black Box Pentest. During this test, a publicly exposed “anonymous” key, often mistakenly treated as harmless by developers, served as the catalyst for a total compromise of the company’s customer database.
- Published
- Collected
--- id: 7495 title: "Supabase Leaks, What We Found" source_domain: labs.cognisys.group source_url: "https://labs.cognisys.group/posts/Supabase-Leaks-What-We-Found/" published_at: "2026-02-02T09:10:00Z" tags: ["cloud-security", "pentesting", "account-takeover", "ssrf", "supabase", "baas"] phying_url: "https://phying.com/item/7495" lang: en --- # Supabase Leaks, What We Found ## Summary In late 2025 and early 2026, the cybersecurity landscape witnessed a disturbing trend involving the mass disclosure of Supabase API keys. This pattern came to a head when our team identified a massive leak involving a client who approached us for a Black Box Pentest. During this test, a publicly exposed “anonymous” key, often mistakenly treated as harmless by developers, served as the catalyst for a total compromise of the company’s customer database. ## Intelligence Metadata - **Sources:** labs.cognisys.group - **Published:** 2026-02-02T09:10:00Z - **Original:** https://labs.cognisys.group/posts/Supabase-Leaks-What-We-Found/ - **Phying News:** https://phying.com/item/7495