that lovable + supabase research is wild (and what a free outside check can actually see)
ok so people are freaking out about the crissy field lovable writeup and… yeah. the numbers are rough. they looked at 159,041 lovable projects. 34,545 used supabase. 24,664 of the ones they dug into were already shipping database records on first page load with no login. that alone is not automatically a bug — some of that data is meant to be public. they then made additional read-only requests…
A recent study on Supabase projects found that 34,545 out of 159,041 analyzed projects utilized Supabase, with 24,664 of those already displaying database records on their first page load without requiring login. While some of this data is intended to be public, the researchers discovered that 10,560 tables across 7,403 sites contained emails that could be accessed with a simple read-only request using a public key.
However, it's essential to clarify that a ~30% figure does not represent a confirmed leak rate for all Loval projects. Instead, it only applies to the 24,664 sites they examined more closely.
The primary concern, according to the researchers, is not the presence of an anonymous key but rather missing or overly permissive row-level security (RLS) settings. An anonymous key being in the browser is expected, but a service_role key exposed in client code is a significant issue. The researchers recommend running a free outside scan to identify potential vulnerabilities, such as missing RLS policies, open write policies, and client-side Supabase functions with insufficient security measures.
They emphasize that this type of scan is not a replacement for a full penetration test or guarantee of security but rather a "did I leave the door labeled?" check.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
