My Lovable app got hacked, what do I do?

Updated May 1, 2026

Short answer

First, don't panic. Rotate your Supabase service-role key + any API keys, force-logout every user, and email anyone whose data may have been accessed. Then get a plain-English scan so you know exactly what's still exposed. Lovable-specific: the #1 cause is a Supabase RLS policy that lets any logged-in user read every row.

Before anything else, take a breath and do these four things in order:

**Rotate keys.** In Supabase, click Settings → API → reset the service-role key. In Stripe, roll the secret key. In OpenAI, revoke and regenerate. Anyone who had the old keys is now locked out.

**Force-logout everyone.** In Supabase Auth, go to Users and invalidate all sessions. Attackers who logged in with stolen credentials are now logged out.

**Check what was accessed.** Supabase logs show every query that ran. Look for bulk reads of user-data tables — that's the sign of data being stolen. In Stripe, check for unexpected refunds, subscription changes, or new accounts.

**Email affected users within 72 hours.** GDPR and most state laws require this. One honest email is infinitely better than being caught hiding it later.

**The #1 cause on Lovable** is a Supabase Row-Level-Security (RLS) policy that lets any logged-in user read every row in a table, not just their own. The fix is one SQL migration. When your repo is enabled, Securie will tell you exactly which tables are affected, in plain English. Request access at /scan.

My Lovable app got hacked, what do I do?

People also ask