What happened
In March 2025 a security researcher scanned the home pages of 1,645 projects from Lovable's public showcase and found exposed database endpoints in 170 of them, about 10%. Depending on the app, what could be read included names and email addresses, keys for other services and payment details, and some tables could be written to as well. He reported it to Lovable that month, and it was published as CVE-2025-48757 in May 2025, rated critical.
Lovable disputes the CVE. Its position is that each customer is responsible for protecting their own app's data. In April 2025 it added a Security Scan to the publish step for apps connected to Supabase; the researcher's view is that it checks the rules exist rather than that they are right.
The setting behind it
Apps built this way often talk to their database straight from the browser, using a public key. That is a normal, supported design, but it means the database's own rules are the only thing deciding who sees what. In Supabase, which many Lovable apps use, those rules are called Row Level Security (RLS). Supabase's guidance is to turn RLS on for every table the app exposes, and to keep its service key on the server, because that key ignores the rules entirely.
Five checks you can run today
- Row Level Security is on for every table. In Supabase, each table shows whether RLS is enabled.
- The rules actually restrict. Sign in as two different users and check that neither can see the other's records.
- No secret keys reach the browser. The Supabase service key, payment keys and AI keys belong on the server, never in code the browser downloads.
- Backups are on, and someone has tried restoring one.
- Someone is told when it breaks, before your customers tell you.
The same questions apply to any tool
None of this is special to Lovable. Software built with Bolt, v0, Cursor, Claude Code or by hand has the same questions to answer. The difference with AI tools is speed: an app can reach real users before anyone has asked them.
If you'd like someone to check
An Essential Review (£1,500) covers these and the rest of the eleven areas we score, with a named engineer checking every finding, and anything that needs fixing comes with a fixed price. What an audit checks explains the rest.