2026-10-24

The Lovable RLS hole: one missing policy exposed whole databases

In 2025, researcher Matt Palmer found that many apps built with Lovable shipped without proper Row Level Security (RLS) on their Supabase tables. The result: anyone holding the public anon key, which sits in every page, could read or write whole tables. It was filed as CVE-2025-48757, rated 9.3 critical. Lovable disputes it, saying each app owner is responsible for their own data. Either way, the risk is yours.

Read Palmer's write-up for the details.

Check yours today: open the Supabase Security Advisor, turn on RLS for every table in the public schema, and make sure no policy lets anon read every row.