Is Lovable safe? A security guide for Lovable apps
Lovable generates a React frontend that usually talks to a Supabase backend directly from the browser, using the Supabase JavaScript client and the public anon key. That architecture is fine when your Row Level Security policies do the gatekeeping. The gap is that the generated SQL migrations create your tables but often never enable RLS, so the same public key can read them.
The Lovable architecture, and where it leaks
Your React app calls Supabase directly with the anon key baked into the frontend. Nothing sits between the browser and your database except Supabase's own access rules.
When Lovable scaffolds a table through a raw SQL migration, that migration creates the table but does not add RLS unless it is told to. The app works, and the table is wide open to anyone with the anon key.
What to check on a Lovable app
- Row Level Security enabled and policed on every table the client can query.
- Only the anon or publishable key in the bundle, never a service_role key (it bypasses RLS entirely).
- Supabase Storage buckets that hold uploads set to private.
- No object one user can read by supplying another user's ID.
How to check your Lovable app
Lovable's built-in security review checks your project and its Supabase setup from inside the builder. ArgosX adds the outside view: it tests the deployed app, and on Pro signs in as two separate users to prove whether one can reach the other's data, with the request and screenshot, plus an optional human-verified pass.
Common questions
What is the most common security issue in Lovable apps?
A Supabase table created by a generated SQL migration that never enabled Row Level Security. The app works, but the public anon key can read the whole table. It is the most widely reported leak pattern in Lovable apps (see CVE-2025-48757) and the one we check first.
Is the Supabase anon key in my Lovable bundle a problem?
The anon key is meant to be public; that is by design. What makes it safe or unsafe is your RLS policies. A service_role key in the bundle, on the other hand, is a serious leak because it bypasses RLS entirely.
Check your own app for this, free.
A free scan runs in minutes, no signup. Where it finds this, it proves it with the request and screenshot, not just a maybe. A human-verified pass is available when you want a person on our team to review the findings.