Is Lovable's security scan enough for a Supabase app?

Lovable's Quick scan runs when you open the publish dialog and checks database access rules, leaked-password protection, npm dependencies and MCP. The Deep scan reviews your code on demand. Both run before launch. Supahound watches the traffic after launch, so run both.

Does Supahound work with Lovable Cloud?

Supahound connects to Supabase organizations you authorize through OAuth. Lovable's docs say Cloud is built on Supabase's open-source foundation, but they do not describe authorizing it as your own Supabase organization. If your app uses your own project through Connectors > Supabase, Supahound can watch it.

What was CVE-2025-48757?

Researchers scanned 1,645 Lovable projects in March 2025 and found 303 endpoints across 170 projects with inadequate RLS. The CVE record names insufficient RLS in Lovable through 2025-04-15. The record is tagged disputed, and Lovable says each customer is responsible for their app's data.

Do I give Supahound the same access I gave Lovable?

No. Lovable writes migrations, deploys functions and stores secrets in your project. Supahound only reads: you authorize the organization with the read-only analytics:read, database:read and projects:read scopes, and it never asks for a service-role key.

Lovable + Supabase

Monitor the Supabase backend of your Lovable app

A Lovable app calls Supabase from the browser with the key in VITE_SUPABASE_PUBLISHABLE_KEY, so RLS policies are the only thing between a visitor and your tables. Connect the Supabase project behind your Lovable app to Supahound. It checks RLS coverage daily for free and, on paid plans, flags cross-tenant reads, service-key misuse and scraping in the edge logs.

Last updated 2026-11-09

Start free Read the Lovable security guide

Lovable has a built-in Supabase integration.

What are the Supabase security risks in Lovable apps?

Open tables behind the shipped publishable key
Lovable's Secrets doc lists VITE_SUPABASE_URL and VITE_SUPABASE_PUBLISHABLE_KEY as frontend variables embedded in the bundle at build time. A table without RLS, or with a permissive policy, answers anyone who copies them. That is the pattern behind CVE-2025-48757, a CVE tagged disputed; Lovable says each customer is responsible for their app's data.
Policies that exist but check the wrong thing
Lovable runs automated RLS coverage checks after schema changes. Coverage proves a policy exists, not that it checks ownership. Researcher Matt Palmer said the first Lovable 2.0 security scan only checked whether a policy existed.
Edge functions that hold secrets
Lovable puts keys such as Stripe, Resend and LOVABLE_API_KEY in edge functions. Its docs note that a client can still call server-side functions, and that code using the service role must check permissions itself.
Two Lovable projects on one Supabase project
Lovable's docs warn that several Lovable projects connected to the same Supabase project overwrite each other's secrets. A function can end up running with another app's keys.
Supabase credentials hardcoded in source
TNW reports that in April 2026 a researcher disclosed that a free Lovable account could read other users' public projects through Lovable's API, including hardcoded Supabase credentials. Lovable first said it did not suffer a data breach. A key in source is only as private as the source.

How does Supahound protect your Lovable app?

The free daily posture scan checks RLS coverage, Security Advisor findings, views without security_invoker and newly exposed tables after each Lovable migration.
The cross-tenant read detector catches a signed-in user reading other users' rows through a policy that passed Lovable's coverage check.
The service-key detector flags the service key used from a new network or a browser, the sign that a key left an edge function or the source.
After 7 days of learning, the scraping detector flags an actor paging through your tables with the publishable key.
The free /hack-me scan checks your published Lovable domain for Supabase keys in public JavaScript, plus headers and TLS, once you prove DNS ownership.

Frequently asked questions

Is Lovable's security scan enough for a Supabase app?: Lovable's Quick scan runs when you open the publish dialog and checks database access rules, leaked-password protection, npm dependencies and MCP. The Deep scan reviews your code on demand. Both run before launch. Supahound watches the traffic after launch, so run both.
Does Supahound work with Lovable Cloud?: Supahound connects to Supabase organizations you authorize through OAuth. Lovable's docs say Cloud is built on Supabase's open-source foundation, but they do not describe authorizing it as your own Supabase organization. If your app uses your own project through Connectors > Supabase, Supahound can watch it.
What was CVE-2025-48757?: Researchers scanned 1,645 Lovable projects in March 2025 and found 303 endpoints across 170 projects with inadequate RLS. The CVE record names insufficient RLS in Lovable through 2025-04-15. The record is tagged disputed, and Lovable says each customer is responsible for their app's data.
Do I give Supahound the same access I gave Lovable?: No. Lovable writes migrations, deploys functions and stores secrets in your project. Supahound only reads: you authorize the organization with the read-only analytics:read, database:read and projects:read scopes, and it never asks for a service-role key.

Watch your Lovable app's Supabase traffic

Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.

Start free See pricing

Sources

Checked on 2026-11-09. Products change; check each source for current details.