The Lovable vulnerability that exposed databases of 170+ apps
Discovered: January 2025 | Published: May 29, 2025
Check If Your App Is VulnerableIn January 2025, security researcher Matt Palmer (a Replit employee) discovered a widespread security vulnerability affecting applications built with Lovable, a popular AI code generation platform.
The vulnerability stemmed from missing or misconfigured Row Level Security (RLS) policies in Supabase databases. When developers used Lovable to generate apps, the AI would create database tables without properly configuring RLS - leaving user data exposed to anyone who could query the database.
Out of 1,645 Lovable apps scanned, 170 apps (10.3%) had exposed databases with a combined 303 vulnerable API endpoints.
Matt Palmer discovers the vulnerability while researching AI-generated app security
Responsible disclosure to Lovable team. Affected app developers notified.
CVE-2025-48757 publicly disclosed
Lovable achieves SOC 2 Type 2 compliance and ISO 27001:2022 certification
Lovable uses Supabase as its exclusive backend. When the AI generates database tables, it often fails to:
This left tables accessible to anyone with the public anon_key - which is always exposed in the app's JavaScript.
// 1. Attacker finds Supabase URL in the app's JavaScript
const supabaseUrl = "https://xxx.supabase.co"
const anonKey = "eyJ..." // Public anon key (always exposed)
// 2. Creates a Supabase client
const supabase = createClient(supabaseUrl, anonKey)
// 3. Queries tables directly - no RLS means all data returned
const { data } = await supabase.from('users').select('*')
// Returns ALL user data: emails, passwords, payment info...Without RLS, the database trusts the anon_key and returns all data.
service_role access in some cases"This is the single biggest challenge with vibe coding. The most obvious problem is that they're going to build stuff insecurely. We're due for a very rude awakening."
Simon Willison
Veteran Developer & AI Researcher
"Best practice is to avoid letting users access the database directly at all."
Alex Stamos
CISO, SentinelOne
To their credit, Lovable has taken steps to address the vulnerability:
Security Scan Feature
Built-in scanner that checks if RLS is enabled (but not if it's correctly configured)
AI Security Review
AI-powered security review tool for generated code
API Key Detection
Warns when API keys are detected in chat
SOC 2 & ISO 27001
Achieved SOC 2 Type 2 and ISO 27001:2022 certification (August 2025)
Run Lovable's Built-in Security Scan
Go to your Lovable dashboard and run the Security Scan feature. It will tell you if RLS is enabled on your tables.
Check Supabase Dashboard
Go to Authentication → Policies in your Supabase dashboard. Every table with user data should have RLS enabled AND have policies defined.
Test Your Deployed App
Use Vibe App Scanner to test your deployed application. We'll attempt to access your database without authentication and tell you if data is exposed.
Scan Your App-- 1. Enable RLS on all tables with user data
ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
-- 2. Create policies that restrict access to row owners
CREATE POLICY "Users can only access own data"
ON your_table
FOR ALL
TO authenticated
USING ((select auth.uid()) = user_id);
-- 3. Test: This should return 0 rows when run as anonymous
SELECT * FROM your_table;CVE-2025-48757 is a critical security vulnerability affecting apps built with Lovable. It involves missing or misconfigured Row Level Security (RLS) policies in Supabase databases, which allowed unauthorized access to user data across 170+ applications.
170 out of 1,645 Lovable apps scanned (10.3%) were found to have exposed databases. These 170 apps had 303 vulnerable API endpoints that could be exploited to access user data.
Not automatically. While Lovable has added security features, existing apps need to be manually reviewed and fixed. You must enable RLS on all tables and create appropriate policies. Use the Security Scan feature in Lovable or scan your app with VAS to check.
Scan your Lovable app to find RLS misconfigurations and other security issues before attackers do.
Last updated: January 15, 2026