← All guides

Is your Lovable app’s Supabase database exposed? A 10-minute RLS check

CVE-2025-48757 showed many Lovable apps with missing or weak Row Level Security. Check your tables, leaked keys and policies step by step.

Lovable apps call Supabase directly from the browser with a public key and rely entirely on Row Level Security (RLS) to protect data. A March 2025 scan behind CVE-2025-48757 found 303 vulnerable endpoints across 170 of 1,645 analyzed Lovable projects (about 10%). Lovable disputes the CVE, but the takeaway stands: check your own policies.

Step 1: is RLS enabled on every table?

In the Supabase SQL editor run:

select tablename, rowsecurity
from pg_tables where schemaname = 'public';

Any row with rowsecurity = false is readable and writable by anyone with your public key. Fix:

alter table public.profiles enable row level security;

Step 2: look for policies that let everyone in

select tablename, policyname, cmd, qual, with_check
from pg_policies where schemaname = 'public';

Red flags: qual or with_check = true on insert/update/delete, and auth.role() = 'authenticated' or auth.uid() is not null on private data. Those mean any signed-up user can read everyone’s rows. Scope to the owner instead:

create policy "own rows" on public.messages
  for select using (auth.uid() = sender or auth.uid() = recipient);

Step 3: test as an attacker would

Open the Network tab on your live app, copy a request to /rest/v1/<table>, and try ?select=* while logged out and as a second test user. You should only see your own rows.

Step 4: check for leaked secret keys

Search your repo and built JS for sk_live_, sk-, sb_secret_ and any JWT whose role is service_role. The service-role key bypasses all RLS and must never be in browser code. If you find one, rotate it immediately.

Note: RLS on with zero policies

That is secure but returns empty data, a common reason a dashboard is "empty in production". Add a select policy for the rows users should see.

Not sure? Let us check.

The $19 DeployFix Scan checks your RLS policies and finds leaked keys in your code, and you get a ranked report in plain English. If we find something, we can open a fix PR too.

Scan my app – $19

Sources