← All leaks & reports

State of Lovable Security · October 2026

What 295 public Lovable apps are leaking

We ran Shippable's static source checks over 295 public GitHub repos built with Lovable — reading committed code only, never touching anyone's live app. Supabase-backed, and it shows: secrets committed to git lead, with Row Level Security misconfigurations close behind.

1. 01.env committed to git · 27.8% of appsReal API keys and database passwords sitting in the repo's history for anyone to read.high
2. 02Secrets made with Math.random() · 19.3% of appsPassword-reset tokens and API keys generated with a predictable random source an attacker can guess.high
3. 03Admin-rights DB function anyone can call · 15.3% of appsA Postgres function that runs with elevated rights and has no caller check, exposed to every visitor.high
4. 04Database tables open to the public · 14.6% of appsRow Level Security off or a public-read policy, so anyone can read the table's rows.critical
5. 05Edge function with no access check · 12.2% of appsAn API endpoint that trusts the frontend to keep it safe and checks nothing itself.high
6. 06Users can edit their own permissions · 10.2% of appsRLS lets a row's owner update sensitive columns like role or plan — self-service admin.high
7. 07DB function with no fixed search_path · 8.5% of appsA security-definer function an attacker can hijack by shadowing a table or function name.medium
8. 08Injectable PostgREST filter · 7.8% of appsUser input dropped straight into a .or()/.filter() string, letting a caller rewrite the query.medium
9. 09Storage bucket open to everyone · 7.5% of appsA storage policy anyone can read from or write to — uploaded files listable by the public.high
10. 10Anyone (signed out) can write · 6.8% of appsAn RLS insert/update policy granted to the anon role.high
11. 11Stack traces leaked to users · 5.8% of appsErrors returned raw to the client, handing attackers table names and internals.low
12. 12Hard-coded fallback secret · 5.8% of appsCode like process.env.SECRET || "dev-secret" that silently ships the weak default to production.high

Plus 30 more check types seen less often.