It’s Lovable using Supabase incorrectly, so Lovable is rightly to blame.

To add some nuance: Supabase’s security controls aren’t the simplest to work with and have been a source of confusion -- and data exposure -- for years. But Lovable markets its product specifically to people who, it claims, don’t need that technical knowledge. That sets the expectation that Lovable will get Supabase access controls right.