Is Lovable secure? The builder scans your app before you publish, but what your Supabase policies actually allow is a separate question.

Lovable's own docs say its scans "do not replace a thorough security review." So I built an audit tool for apps made with Lovable, Bolt, Base44 and Replit. It reads the Supabase migrations and Edge Functions and reports, in plain English, what a stranger could do with them.

What it found In our scan of 40 public apps built with Lovable and Bolt on Supabase (November 2026), 17 had at least one critical issue and 33 at least one high-severity issue. Public code only: no live app was probed, nobody was contacted, no app is named. Every critical and high finding was read by hand against the code.

What to search for in your own migrations • A table with no "enable row level security" line. Anyone with your public anon key can read and change it. • A write policy with using (true) or with check (true). Anyone can add, change or delete rows. • A security definer function that never checks auth.uid(). On Supabase it skips RLS, and in an exposed schema it can be called through the API. • A role or plan read from user_metadata. Supabase lets the signed-in user edit that field; app_metadata is the one they can't. • An Edge Function that touches user data or keys but never checks who is calling.

RLS turned on is not the same as RLS that's right.

Have you read what your policies allow, or only checked that RLS is on?