Turn on RLS in a Lovable + Supabase app
CVE-2025-48757: 170 Lovable apps with missing RLS · Security incident · Web · mattppal · May 2025
Two researchers scanned 1,645 showcased Lovable apps and found 303 Supabase endpoints in 170 projects readable or writable without login, exposing emails, payment details and API keys.
Lesson
Turn on RLS with ownership-based policies for every table, then try unauthenticated reads yourself.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
My app uses Supabase (or Firebase) and I built it with Lovable. Please check whether my database is open to anyone. 1) List every table and storage bucket and whether Row Level Security (or security rules) is enabled. 2) For each table, explain who can read and write it now, in plain English. 3) Propose the minimum policies so users only see their own rows, public content is read-only, and plan, role or credit columns can't be changed by users. 4) Give me the SQL or rules to apply, and a test with two accounts and a logged-out browser. Don't use or ask for the service_role key. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Web ↗