VibeGuard daily security tipshttps://vibeguardscan.com/posts/One short security tip a day for vibe-coded apps.enSat, 24 Oct 2026 04:00:00 GMT The Lovable RLS hole: one missing policy exposed whole databaseshttps://vibeguardscan.com/posts/2026-10-24https://vibeguardscan.com/posts/2026-10-24Sat, 24 Oct 2026 04:00:00 GMTIn 2025, researcher Matt Palmer found that many apps built with Lovable shipped without proper Row Level Security (RLS) on their Supabase tables. The result: anyone holding the public anon key, which sits in every page, could read or write whole tables. It was filed as CVE-2025-48757, rated 9.3 critical. Lovable disputes it, saying each app owner is responsible for their own data. Either way, the risk is yours.

Read Palmer's write-up for the details.

Check yours today: open the Supabase Security Advisor, turn on RLS for every table in the public schema, and make sure no policy lets anon read every row.

Scan your app free with VibeGuard

]]>