AI-Assisted Website Development: The Risk of Customer Data Leaks

AI makes it possible to quickly build websites with user registration, customer accounts and order processing. For businesses, this offers a convenient way to launch a project. However, errors in generated code and configuration can go unnoticed while customer data is already accessible to outsiders.

More Than 16,000 Databases with Publicly Accessible Tables

In September 2026, UpGuard researchers published a study identifying 16,326 Supabase databases with publicly readable tables. Supabase is a platform for storing data and providing backend services for websites, and it is also popular in AI-assisted development. More than half of the identified databases showed signs of containing personal information, while some included passwords and authentication tokens.

Behind these figures are real businesses and their customers. A US valet parking service exposed information on more than 100,000 customers, including phone numbers, vehicle registration numbers and visit histories. At a Canadian relocation assistance service, researchers found nearly 5,000 user records and 884 passwords stored in plain text.

Errors That Routine Website Checks Can Miss

The exposure resulted from access configuration errors. Rules determining which records a user was allowed to read were either missing or ineffective. As a result, databases could return information to unauthorised users. Having a login form on a website does not, by itself, prevent this problem.

The researchers link the scale of the problem to the growth of AI-assisted development, where project owners may not understand how the resulting system is configured. However, the study does not establish that every affected website was built using AI.

For business owners, the difficulty is that these errors do not necessarily stop a website from working. Orders come through, registration works and customers can access their accounts. Everything may appear normal during routine testing, while the ability to retrieve other users’ data remains unnoticed.

Checks Before Launch

At FairyHosting, we recommend having a specialist review the code and access permissions before launching a project that handles real customer data. It is essential to verify that visitors cannot retrieve other people’s orders, contact details or private messages by sending requests directly to the server. This is particularly relevant to projects built with AI that have not yet undergone a technical review.

If you are preparing to launch a website like this, the specialists at FairyHosting will be happy to help with hosting and ongoing technical support.