Picture an invoicing app called Billtrack, built in a weekend with Lovable. It has a Supabase database with one table, invoices , and two users, Alice and Bob. Alice should see her two invoices. Bob should see his one.

The app works. Alice logs in and sees her invoices. Then anyone who opens the browser's network tab can copy the Supabase URL and the anon key out of a request, run one curl , and get all three invoices, including Bob's.

That is the bug behind CVE-2025-48757. A security researcher scanned 1,645 apps from Lovable's public showcase and found 170 with Supabase tables readable using only the public key. The exposed data included emails, addresses and in some cases API keys. The NVD entry notes that Lovable disputes the CVE, on the grounds that each customer is responsible for protecting their own app's data. Either way, the fix is in the app's database.

It wasn't a one-off.…