---
id: 7495
title: "Supabase Leaks, What We Found"
source_domain: labs.cognisys.group
source_url: "https://labs.cognisys.group/posts/Supabase-Leaks-What-We-Found/"
published_at: "2026-02-02T09:10:00Z"
tags: ["cloud-security", "pentesting", "account-takeover", "ssrf", "supabase", "baas"]
phying_url: "https://phying.com/item/7495"
lang: en
---

# Supabase Leaks, What We Found

## Summary

In late 2025 and early 2026, the cybersecurity landscape witnessed a disturbing trend involving the mass disclosure of Supabase API keys. This pattern came to a head when our team identified a massive leak involving a client who approached us for a Black Box Pentest. During this test, a publicly exposed “anonymous” key, often mistakenly treated as harmless by developers, served as the catalyst for a total compromise of the company’s customer database.

## Intelligence Metadata

- **Sources:** labs.cognisys.group
- **Published:** 2026-02-02T09:10:00Z
- **Original:** https://labs.cognisys.group/posts/Supabase-Leaks-What-We-Found/
- **Phying News:** https://phying.com/item/7495