lovable security: A 3-Step Supabase Check After a Study of 159,041 Lovable Apps

Lovable security is getting attention this weekend. Security firm Crissy Field, working with Handelsblatt, looked at 159,041 Lovable projects and found many apps where personal data could be read without logging in. If you built a client site, a booking form or an internal tool with Lovable (or any AI app builder) on top of Supabase, here is what the study found and a short check you can run today. This is a research-based summary, not a hands-on audit.

What the study found

From Crissy Field's research report:

• They found 159,041 Lovable projects in Common Crawl data from December 2025 to September 2026. 34,545 of them used Supabase.
• 24,664 sites sent Supabase records as soon as the page loaded, with no login. That alone isn't a problem, since some data is meant to be public.
• With further read-only requests using the same public key, they found tables with email addresses on 7,403 of those 24,664 sites (30%). The authors say this is not a confirmed leak rate, and their sample doesn't represent every Lovable app.
• Examples included forum profiles and chat messages, ticket and food orders, identity document details, contracts and invoices.

They also point out that Lovable's terms put responsibility for apps and data handling on the customer. The study was discussed widely on Hacker News.

Why this happens

A Supabase front end talks to the database with a public key. What keeps data private is Row Level Security (RLS) plus the right grants. The Supabase RLS docs are blunt: a table in an exposed schema without RLS is readable and writable by any role with a grant on it. On many projects, anon (signed-out visitors) and authenticated get every privilege on new public tables by default, and adding policies doesn't take those grants back.

A 3-step lovable security check

1. Turn on RLS for every exposed table. In the Supabase dashboard, check each table in public. Any table without RLS is a red flag.

alter table public.orders enable row level security;

2. Write a policy for each table, and trim the grants. A typical rule lets people read only their own rows:

create policy "Users read own orders"
on public.orders for select
to authenticated
using ( (select auth.uid()) = user_id );

-- signed-out visitors shouldn't touch this table at all
revoke all on public.orders from anon;

Give anon only what visitors really need to see, like a public menu or price list.

3. Test it logged out, and keep secrets out of the browser. Open the app in a private window without signing in and see what loads. The Supabase docs also say never to put a secret (service_role) key in the browser, because it bypasses RLS. Repeat this check after every big change the AI makes to your app.

When to call in help

Crissy Field's advice is simple: an easy builder doesn't remove the need for a proper review of access permissions before an app handles real customer data, and automated checks don't replace a professional assessment. If your app stores customer emails, payments or ID details, get a second pair of eyes on it.

More research-based AI news for small businesses and creators at ainews.useaifix.com. Need help with AI automation for your business? See useaifix.com.