Secrets & exposed data

API keys, databases and services reachable without authentication.

Aisle of a dark server room, racks lit by green and blue status lights

Secrets & exposed data26 Sept 2026 · 9 min read

16,326 Supabase databases anyone can read

A UpGuard study published on September 25, 2026 found 16,326 Supabase databases with tables anyone can read, with no authentication and no exploit required. The cause fits in one sentence: the Table Editor protects by default, the API AI agents actually use doesn't.

Unplugged orange network cables dangling in front of a dark patch rack

Secrets & exposed data12 Sept 2026 · 5 min read

21,000 MCP servers exposed on the internet: why authentication is "optional"

Censys counted more than 12,500 internet-reachable MCP servers in April, then more than 21,000 in May. A study published in late July audited 414 of them: 91.8% had no OAuth authentication. How the protocol works, and how things got here.

Brass dial of an old safe on a weathered wooden door

Secrets & exposed data2 Sept 2026 · 4 min read

29 million secrets on GitHub: what AI changes about leaked keys

GitGuardian's annual report counts 28.65 million secrets exposed on public GitHub in 2025, +81% for AI keys, and Claude Code-assisted commits leaking at twice the average rate. How a key ends up in a bundle, and how to stop it.