Lovable

Record description

Lovable is the application-building platform at the center of the 2025 database Row Level Security disclosure. The examined applications used browser-facing interfaces backed by Supabase. The security issue concerned what the backend permitted after a caller bypassed the interface, rather than the presence of a public client credential alone.

Matt Palmer's disclosure describes sampled deployed projects and a Linkable follow-up; Escape's later study provides a separate, multi-platform dataset. Neither establishes the present security of every Lovable application. The CVE record also preserves Lovable's dispute over responsibility for customer application data. A platform, an application operator and a backend provider must therefore remain distinct actors when interpreting the findings.

Explicitly related research (2)

Declared connections