ResearchMarch 2026
We checked 50 Lovable apps' Supabase RLS. 43 were vulnerable.
Most apps had RLS 'enabled' but used USING(true) — which grants full public access. Here's what we found and how to fix it.
Read more →Security research, case studies, and guides for AI-built apps.
Most apps had RLS 'enabled' but used USING(true) — which grants full public access. Here's what we found and how to fix it.
Read more →USING(true) is the most common RLS policy mistake in vibe-coded apps. We explain the difference between RLS enabled and RLS secured.
Read more →A real case study of an AI key leaked in client-side JavaScript. How much it cost, how fast it was exploited, and how to prevent it.
Read more →Lovable checks headers and basic config. But it can't connect to your Supabase to validate RLS policy logic. Here's what's missing.
Read more →We analyzed 100 Firebase projects from GitHub. 67% had completely open Firestore rules. Here's the one-line fix.
Read more →