Lovable app hacked / the first hours

Your Lovable app got hacked. Here is the next few hours.

Maybe a stranger emailed you a screenshot of your users table. Maybe a researcher posted about it. Maybe you ran a check and your stomach dropped. First, the thing nobody says: this happens to a lot of Lovable apps, and it is not because you are careless. It is not your fault. It is, however, your problem now, and the next few hours matter more than the next few weeks.

first hour · triage order
confirm what actually happenedNOW
take it private if actively leakingNOW
rotate service + API keysNOW
preserve logs, delete nothingNOW
map blast radius from logsNEXT
notification call with counselNEXT
panic deletes evidence. calm rotates keys. work the list top to bottom.

The short answer

Do not panic and do not delete anything. If data is actively exposed, take the app private or pause signups. Rotate every key an attacker could have seen, starting with the Supabase service role key. Preserve logs and timestamps. Then work out what was actually reachable before deciding who to tell.

Step 1

The first hour: stabilize without destroying evidence.

Everything in this hour is reversible or protective. Nothing in this hour is a fix. Fixing comes later, once you know what you are fixing.

1
Confirm what happened vs what you fear happened
Write down exactly what you have seen: the screenshot someone sent you, the strange rows, the email from a stranger. Then separate that from what you fear. "A researcher read my users table" and "everything is stolen" call for different responses, and the first hour is for establishing which one you are in.
2
Stop active bleeding, gently
If data is exposed right now, take the app private, put it behind a holding page, or pause new signups. In Lovable that can be as simple as unpublishing; in Supabase you can pause the project. Prefer the smallest action that stops the exposure. You want the app quiet, not destroyed.
3
Rotate every key the attacker could have seen
The Supabase service role key first, then third-party API keys (Stripe, OpenAI, Resend, anything in your integrations), then OAuth client secrets. The anon key is public by design, but if row-level security was off it was acting as a master key, so rotate it too and fix RLS before re-enabling access. If you suspect an account was taken over, also force a global sign-out: rotating the JWT secret in Supabase invalidates every active session, the attacker’s included. Your users will have to log back in, a fair price mid-incident.
4
Do not delete anything
Not the attacker’s account, not the weird rows, not the suspicious edge function. Deleting feels like cleaning; it is actually destroying the record of what happened. You will need that record to measure blast radius, and possibly to satisfy notification duties later.
5
Preserve logs and timestamps now
Export Supabase API logs, auth logs, and Postgres logs before retention windows eat them. Screenshot dashboards with timestamps visible. Note when you first noticed, when you acted, and what you changed. A boring timeline written today is worth more than a vivid memory next week.

One note on the anon key, because it confuses everyone: the Supabase anon key is meant to be public, so finding it in your page source is not the breach. The breach is what that key was allowed to do. If row-level security was off, the anon key was functionally a master key, and you should treat everything it could reach as exposed.

Step 2

The four places Lovable apps actually leak.

Once the bleeding is stopped, check these in order. Across the public incident record for Lovable-built apps, the overwhelming majority of real leaks trace to one of these four surfaces.

S1
Row-level security off or misconfigured
The most common hole in Lovable apps by a wide margin. Without an RLS policy, the public anon key can read or write a table directly through the Supabase REST API, no login required. Check every table, and check that policies actually scope rows to their owner rather than merely existing.
S2
Secrets shipped in client code
Search your built frontend for anything that looks like a key: service role keys, Stripe secret keys, OpenAI keys pasted into a component during a late-night prompt. Anything in the browser bundle is public. Those keys are burned; rotate them and move the calls behind an edge function.
S3
Edge functions
Check each Supabase edge function for missing auth checks (does it verify the caller, or does it trust whatever the request claims?), for secrets returned in responses, and for write operations anyone can trigger. Functions Lovable generated on request are exactly as safe as what was asked for.
S4
Publicly readable storage buckets
Supabase storage buckets marked public serve every file to anyone with the URL, and URLs are often guessable. If your app stored uploads, exports, invoices, or avatars, confirm which buckets are public and whether anything sensitive lives in them.

Lovable ships built-in security scanners, and they are worth running. But Lovable's own documentation is direct about their limits: the security overview states that the scanners "do not replace a thorough security review" and that you are responsible for your app meeting the security requirements of its use case (as of July 2026). After an incident is exactly when that distinction matters. For the calmer, pre-incident version of this check, see is Lovable safe.

Step 3

Blast radius: what was reachable, and for how long.

Two questions define your incident, and everything you owe your users flows from the answers. What data was reachable? And for how long?

What was reachable. For every table without a working RLS policy, list the columns and ask what they contain: emails, names, addresses, payment identifiers, messages, anything about children or health. Do the same for public storage buckets and for anything an unauthenticated edge function would return. Be honest with the list; you are writing it for the version of you that talks to a lawyer.

For how long. The exposure window opens when the misconfiguration shipped, not when you noticed. Find when the table was created or the bucket made public, then use Supabase API logs to look for actual suspicious reads inside that window. Logs can shorten the story from "exposed for three months" to "exposed for three months, with evidence of one read by a researcher who reported it." That difference changes the notification conversation entirely.

Two limits to respect: log retention on lower Supabase plans is short, so the absence of logs is not the absence of access. And "reachable" is not the same as "taken." Write down both what you can prove and what you cannot rule out, with timestamps. That document is the backbone of everything that follows.

Step 4

Telling your users: the part everyone wants to skip.

First, the flag: this is not legal advice, and breach notification law genuinely varies by jurisdiction. If personal data was plausibly exposed, a short conversation with a lawyer belongs in your first day, not your first month.

The plain-language version of the landscape: if you have users in the EU or UK, the GDPR expects qualifying breaches to be reported to the regulator within 72 hours of you becoming aware, with affected users informed when the risk to them is high. In the US, notification duties come from state laws that differ in what counts as personal information and how fast you must move. Other countries have their own regimes. Where your users live matters more than where you do.

Whatever the law requires, the human version rarely goes wrong: tell affected users what was exposed, when, what you have done about it, and what they should do, in plain sentences, without euphemism. "We take security seriously" convinces no one. "Email addresses and order histories were readable between March and June; passwords were not; we have closed the hole and here is how we verified it" earns back more trust than silence ever protects.

Step 5

After the fire: proof it is closed, and someone watching.

Verify with a re-runnable proof, not vibes. Keep the exact request that leaked data and run it again after the fix: the curl against the REST API, the console snippet, the bucket URL. Closed means that request now fails, and keeps failing after every future deploy. "The scanner is green now" is not verification; scanners check for the presence of protections, not whether your specific hole is shut. This is the standard our own work is built around: a Ship Check ($299 flat) audits the whole app and attaches a re-runnable proof to every finding, and a Ship Fix ($4K to $15K by scope) closes the dangerous ones with the same proof attached. You can see how that has gone for other founders on the proof page.

Then decide who watches it. Here is the uncomfortable pattern behind most second incidents: a one-time fix with nobody watching afterward is how you end up back on this page. The app keeps changing, you keep prompting, and every change can quietly reopen a surface. What prevents the sequel is not a bigger fix, it is a watcher: a named person responsible for the app between incidents, with checks that re-run on every change. That can be a developer you trust, or an ongoing arrangement like Continuum, which runs from $49 to $199 per month for Watch, $500 to $1,500 per month for Care, and $3,000 to $15,000 per month for Partner. What ongoing upkeep should cost, and why, is a topic we treat honestly in what SaaS maintenance actually costs.

And to be plain about the alternatives, because a hacked founder deserves options, not a funnel: Lovable support can help with platform-side questions, any competent security engineer can work this playbook with you, and fixed-price rescue shops exist, for example Afterbuild Labs offers a $299 Emergency Triage for a single broken production issue (as of July 2026). If your original developer has disappeared mid-incident, we wrote a guide for exactly that, and when you are ready to hand the app to someone who stays, start with the vibe code handoff guide.

Context

You are not the first. The public record, dated.

If it helps to know the scale of the company you are in: this is the verifiable public timeline of security incidents around Lovable and its category. Every entry links to its source.

May 2025
CVE-2025-48757: row-level security off across 170+ Lovable apps
Security researcher Matt Palmer scanned 1,645 Lovable-built apps and reported 170+ with databases readable by anyone, because tables were created without row-level security. The issue was assigned CVE-2025-48757. Lovable has disputed aspects of the CVE's framing, and later analyses note the platform has since added security scanning. The underlying pattern, RLS off by default and nobody turning it on, is the first thing to check on this page for a reason.
July 2025
Base44 authentication bypass (patched)
Researchers at Wiz disclosed a critical flaw in Base44, a competing vibe-coding platform, that let an attacker create a verified account for private apps using only a non-secret app_id, bypassing authentication including SSO. Wix patched it quickly. It belongs on this timeline because it shows platform-level holes happen across the category, not just in your configuration. If you build on Base44, see our Base44 safety page.
February 2026
A Lovable-showcased app reportedly exposed 18,000 users
A researcher claimed a Lovable-showcased EdTech app carried 16 vulnerabilities and exposed data on 18,000+ users, as covered by The Register. Lovable responded that the vulnerable database was not hosted by Lovable and that the app's creator was addressing the issue. Attribution was contested; the users' exposure was not.
April 2026
Lovable project visibility incident
Reports circulated that source code, database credentials, and chat histories were visible on Lovable projects with public visibility settings. Lovable initially described it as intentional behavior, then published a fuller response describing changes to its escalation process. If your project predates November 2025, rotating any credentials that ever lived in it is cheap insurance.
May 2026
RedAccess scan: close to 2,000 apps appearing to leak private data
Researchers at RedAccess analyzed thousands of apps built with Lovable, Replit, Base44, and Netlify and found more than 5,000 with virtually no security or authentication, close to 2,000 of which appeared on inspection to reveal private data, as reported by Wired on May 7, 2026. The platforms pushed back on the framing; Lovable noted that how an app is configured is ultimately the creator's responsibility. Which is precisely why this playbook exists.

The takeaway is not that Lovable is uniquely dangerous. It is that the category ships working apps to people who were never told which switches matter, and the incidents keep arriving on a steady cadence. The founders who come through them well are the ones who moved calmly in the first hours, kept their evidence, and put a watcher on the app afterward.

FAQ

Hacked-app questions, straight answers.

In the first hour: confirm what actually happened versus what you fear happened, take the app private or pause new signups if data is actively exposed, rotate every credential the attacker could have seen (the Supabase service role key, third-party API keys, OAuth secrets), and preserve your logs. Do not delete anything, including the attacker’s rows or accounts. Deleting destroys the evidence you need to work out what was reachable, and in some jurisdictions it complicates your notification duties.
Open the Supabase dashboard and check the API logs and Postgres logs for the affected tables: look for REST requests you did not make, reads at odd hours, sequential scans of whole tables, and requests from unfamiliar IPs. Note the earliest suspicious timestamp, that is the start of your exposure window. Two honest caveats: log retention is limited on lower Supabase plans, so the window may extend before your oldest log, and an absence of log entries is not proof nothing was read. If the table had no row-level security, assume the data was reachable for as long as that was true.
This is not legal advice, and the real answer depends on where you and your users are. Many jurisdictions have breach notification laws: the GDPR expects notification to the regulator within 72 hours of becoming aware of a qualifying breach, and most US states have their own notification statutes with different triggers and timelines. If personal data was plausibly exposed, talk to a lawyer promptly rather than after you have finished fixing things. As a general pattern, an early, honest, specific notice ages far better than a leak your users discover on Reddit.
Usually neither in the way that question implies. Most incidents in Lovable-built apps trace to configuration the platform left open and nobody closed: row-level security off, storage buckets public, secrets shipped to the browser. There have also been platform-level incidents, including one on Lovable itself in April 2026, so it is not always the builder. But fault is the wrong frame in the first hours. Your users trusted the app, not the tool that generated it, so the cleanup is yours to own either way. It is not your fault, but it is your problem.
Keep the exact request that leaked data, the curl command, the console snippet, the URL, and re-run it after the fix. Closed means that same request now returns a permission error or an empty result, every time, and you keep it as a regression check you can re-run after any future change. That is the standard we hold ourselves to as well: our $299 Ship Check attaches a re-runnable proof to every finding so “fixed” is something you can demonstrate, not something you have to take on faith.
Someone with a name, on an ongoing basis. That can be a developer you already trust on retainer, a security engineer you bring in periodically, or a service like Continuum, where ongoing tiers run from $49 to $199 per month for monitoring up to $3,000 to $15,000 per month for a fractional CTO. The specific provider matters less than the structure: a named person accountable for the app between incidents, plus checks that re-run automatically. Apps that get a one-time fix and no watcher are the ones we see back in incident mode months later.

You do not have to
work this list alone.

30 minutes, no pitch. Bring what you know so far; we will help you sort fear from fact.Free scan of your live URL for the four surfaces on this page.

And if the right move is Lovable support or an engineer you already trust, we will say so.

Matt

Last updated: July 2026