Lovable apps expose passport details and more than 200K private messages

Re:Lovable apps expose passport details and more than 200K p... by neathack on Saturday November 14, 2026 @02:31PM (#50500006)

While we’re at it, I was quite surprised to discover that Supabase leaks schema information through the `hint` field in error messages:

https://docs.postgrest.org/en/latest/references/errors.html

For example, if you try to access a table named "secret" that doesn’t exist, Supabase might return a hint saying, "Perhaps you meant the table 'public.super_secret'."

Thanks for volunteering that information, I guess.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by doctorpangloss on Saturday November 14, 2026 @04:56PM (#50501351)

nobody needs supabase.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by steve-chavez on Saturday November 14, 2026 @08:20PM (#50503000)

The hint is not a problem if you use the PostgreSQL default of deny for every table, Supabase is migrating to this default https://github.com/orgs/supabase/discussions/45329. If the defaults are in place even if you see the table name on the hint it will be inaccessible (fails immediately before RLS checks).

Note that the hint is added by PostgREST and it was introduced at a time where users manually typed table names, causing them to report malfunctions on typos. These hints are not that as necessary anymore so they're usually disabled via config[1] and will likely be dropped on a next version.

[1]: https://docs.postgrest.org/en/v16/references/configuration.h...

[ Parent | on HN ]