Is my Lovable app with Supabase vulnerable by default?

Very commonly — AI builders disable RLS by default, so a freshly scaffolded app's database can be readable by anyone with the project URL. It's worth a 2-minute check.

Does the scan modify my data?

No. The probe is read-only and caps itself at a handful of rows; it never writes, deletes, or touches your production data beyond a minimal anonymous read.

What's the actual fix?

Enable Row Level Security on every exposed table and add policies scoped to the logged-in user (auth.uid()), keeping service-role/admin access server-side only.

Exposed data

Supabase RLS Check — Is Your Database Publicly Readable?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

Your Supabase database answers anonymous requests with real rows, meaning anyone who knows your project URL can read — and sometimes change — user data. This is the fastest way an AI-built app gets breached.

Why AI tools generate it

Lovable and other AI builders scaffold Supabase with Row Level Security disabled by default, so a vibe-coded app can ship a fully open database without ever being told it's public.

How DevMeth detects it

A read-only live probe queries your Supabase API the way any visitor can (anonymous, no key, no login) and checks whether tables return rows. We read a few rows at most and never modify anything.

What a finding looks like

Critical

Your Supabase database is readable by anyone on the internet

WHAT WE FOUND

table users — 1,204 rows readable anonymously · sample row masked

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Enable RLS on every table and attach policies anchored to auth.uid() instead of USING (true). The fix prompt includes the exact ALTER TABLE and CREATE POLICY statements and a verification line.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.