Case lovable-rls-exposureModel & data leakSweden
170 Lovable-built apps expose user data through missing Supabase row-level security
Matt Palmer scanned 1,645 Lovable-generated apps and found 170 with 303 endpoints where anyone with the public anon key could dump emails, phone numbers, payment records and API keys. Tracked as CVE-2025-48757.
HighAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- May 29, 2025
- Location
- Sweden
- Target
- Apps generated with Lovable AI app builder
- Severity
- High
- Triggered by
- Matt Palmer (independent researcher)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2025-48757
What happened
Matt Palmer scanned 1,645 Lovable-generated apps and found 170 with 303 endpoints where anyone with the public anon key could dump emails, phone numbers, payment records and API keys. Tracked as CVE-2025-48757.
Impact: Personal data and API keys from at least 170 apps were publicly readable
Who triggered it
Actor: Matt Palmer (independent researcher)
Attribution: Public disclosure after scanning; Lovable's own infrastructure was not breached
Motive: Security research
How it happened
Attack vector: Direct queries to Supabase tables using the public anon key exposed in app JavaScript
Root cause: AI-generated apps shipped without row-level security policies
Timeline
- Palmer first notices the issue on a Lovable-built site
- Public disclosure and CVE-2025-48757
Response
Lovable added security scanning for generated projects; affected developers were urged to enable RLS
Current status: Contained
Sources (open in a new tab)
- Superblocks superblocks.com
- Gigazine gigazine.net
- Vibe App Scanner vibeappscanner.com
Cite this case
170 Lovable-built apps expose user data through missing Supabase row-level security. AI Threat Watch, case lovable-rls-exposure, May 29, 2025. https://aithreat.io/cases/lovable-rls-exposure/
Permanent link: https://aithreat.io/cases/lovable-rls-exposure/