Is Lovable secure?
Lovable apps are safe to ship with review + scanning. Lovable's own platform has had CVEs (2025-48757, April 2026 re-break). Apps built on Lovable routinely misconfigure Supabase RLS (16% leak rate) and expose environment variables. Request Securie access at /scan for a review of yours.
Lovable-the-platform: Has had disclosed vulnerabilities. CVE-2025-48757 (project enumeration) affected 170+ apps at disclosure. Per Cyber Kendra's April 2026 report, a variant re-broke after the patch.
Lovable-built apps: Industry estimates from public security research suggest roughly 16% ship at least one exposed credential and around 13% have at least one Supabase table with RLS disabled. This isn't Lovable-specific — it's the baseline for any vibe-coding platform.
Recommendation: Lovable is safe if you treat its output as AI-generated code that needs review. It's not safe if you assume defaults will protect you.
Specific hardening steps: 1. Audit env var prefixes in your Lovable project — any `VITE_` / `PUBLIC_` prefix on a secret means it ships to every browser 2. Open Supabase Studio → Authentication → Policies. Every table with user data must have RLS ON + a policy scoping by `auth.uid()` 3. Rotate any Supabase service-role key that ever appeared outside server-side code 4. Request Securie access at /scan so the repo can run through Securie review when enabled