{
  "id": 18539227,
  "title": "that lovable + supabase research is wild (and what a free outside check can actually see)",
  "url": "https://urgent.news/2026/11/06/that-lovable-supabase-research-is-wild-and-what-a-free-outside-check",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T17:59:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ad23dev/that-lovable-supabase-research-is-wild-and-what-a-free-outside-check-can-actually-see-7gp"
  },
  "original_language": "en",
  "account": "A recent study on Supabase projects found that 34,545 out of 159,041 analyzed projects utilized Supabase, with 24,664 of those already displaying database records on their first page load without requiring login. While some of this data is intended to be public, the researchers discovered that 10,560 tables across 7,403 sites contained emails that could be accessed with a simple read-only request using a public key. However, it's essential to clarify that a ~30% figure does not represent a confirmed leak rate for all Loval projects. Instead, it only applies to the 24,664 sites they examined more closely.\n\nThe primary concern, according to the researchers, is not the presence of an anonymous key but rather missing or overly permissive row-level security (RLS) settings. An anonymous key being in the browser is expected, but a service_role key exposed in client code is a significant issue. The researchers recommend running a free outside scan to identify potential vulnerabilities, such as missing RLS policies, open write policies, and client-side Supabase functions with insufficient security measures. They emphasize that this type of scan is not a replacement for a full penetration test or guarantee of security but rather a \"did I leave the door labeled?\" check.",
  "summary": "ok so people are freaking out about the crissy field lovable writeup and… yeah. the numbers are rough. they looked at 159,041 lovable projects. 34,545 used supabase. 24,664 of the ones they dug into were already shipping database records on first page load with no login. that alone is not automatically a bug — some of that data is meant to be public. they then made additional read-only requests…",
  "key_points": [
    "34,545 of 159,041 analyzed projects used Supabase",
    "10,560 tables across 7,403 sites contained accessible emails",
    "Researchers recommend free outside scan for potential vulnerabilities"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}