Is your Lovable app exposing data?
Lovable turns a prompt into a working, data-backed app in minutes — and that's exactly where the risk hides. The apps it generates run on Supabase, and by default Lovable doesn't switch on the one setting that keeps strangers out of your database. Here's what that means, the incidents it has already caused, and how to check your app in about ten seconds.
Check your Lovable app now
Paste your app's URL. The free scan reads it from the outside and checks your database access, authentication and secrets. No signup, nothing changed.
Only scan apps you own or have permission for.The short answer
Lovable is a legitimate platform, and a properly configured Lovable app can be perfectly safe. But the apps it builds are only as secure as their default configuration — and that default is often open. The core issue is specific and well documented: when Lovable creates your Supabase database tables, it doesn't turn on Row Level Security (RLS). Without RLS, the public key that ships in your app can read every row of every table.
A single Lovable app was reported in 2026 to have exposed the personal data of over 18,000 users — including people at major tech firms — because its Supabase backend shipped without Row Level Security enabled.
Source: The Register, 2026. Not our data — independent reporting.Why Lovable apps leak by default
Ask Lovable to "add a database" and it wires your app to Supabase, then creates tables for you. The problem is in what it skips: it runs the CREATE TABLE statements but does not enable Row Level Security or write any access policies. Supabase ships a public anon key that lives in your frontend by design — and that key is only safe when RLS is on. With RLS off, anyone can take that public key from your app's JavaScript, query the Supabase API directly, and read your whole database. No login, no exploit.
None of this shows up as an error. Your app works, the preview looks perfect, and there's no warning that the same data is readable by the entire internet. That gap between "it works" and "it's safe" is exactly where these exposures live.
This isn't hypothetical. A critical Lovable RLS misconfiguration was tracked as CVE-2025-48757, and in January 2025 researchers found 170+ Lovable apps exposing emails, API keys, payment details and personal data through the same missing-RLS default (coverage). The platform has improved, but every app built while the default was open — or without RLS added since — is still exposed.
What can go wrong in a Lovable app
Supabase database readable without login (RLS off)
The big one, and the Lovable default. Tables without Row Level Security return every row to the public key — your users, their emails, their data.
Secret keys in the frontend
If your app calls OpenAI, Stripe or another service with a secret key, that key can be bundled into the browser code where anyone can copy it and spend your money.
Broken or inverted permissions
AI-generated access logic can be wrong — letting a logged-in user read or edit records that belong to someone else.
Missing browser protections
Security headers that harden the app against tricks like clickjacking. Minor next to an open database, but worth closing.
How to check your Lovable app
- In the Supabase project behind your app, confirm Row Level Security is enabled with policies on every table that holds user data — Lovable won't have done this for you.
- Open your live app's source and make sure only the public
anonkey is there, never aservice_roleor provider secret key. - Or run the free scan below, which checks from the outside whether your database answers without a login.
Is your Lovable app's database open?
Find out in about 10 seconds. Free, no signup, read-only.
Only scan apps you own or have permission for.What to do if you find something
- Turn on Row Level Security in Supabase for every table, and add policies for who can read and write. This is the single most important fix for a Lovable app.
- Rotate any exposed secret key immediately and move it server-side — treat the old one as compromised.
- Review your access rules so users can only reach their own records.
- Re-scan to confirm your database no longer returns data without a login.
Is Lovable safe to use?
Yes — with one deliberate step. Lovable gives you a real Supabase backend, which is powerful and exactly why the default matters. Turn on Row Level Security, keep secret keys on the server, and a Lovable app can be perfectly safe. The scan above tells you, in seconds, whether yours is locked down or one setting away from exposing its data.