Re:Lovable apps expose passport details and more than 200K p...
by IceDane on Sunday November 15, 2026 @05:21AM
(#50505710)
So I'm a member of a couple of communities where people regularly submit their apps "see what i made".
I would say that something like 3/4 supabase projects that are submitted have issues like this. The latest i found was exposing health-related data.
Supabase is positioned similarly to firebase: you don't need a separate backend, and you access your database directly from the frontend. Security is dependent on relatively complicated rules in your database (simpler for firebase, a lot more involved for supabase with RLS)
This means it's a tool that is frequently reached for by newbies - the same sort of people who are the worst equipped to actually implement these complicated security rules themselves. With the advent of vibecoding, many people building are almost entirely dependent on the AI doing the right thing in every case. And this will get progressively more complicated to do correctly the more complicated the schema and usage patterns become.
I think we are in a territory where it is borderline irresponsible for supabase.
I would say that something like 3/4 supabase projects that are submitted have issues like this. The latest i found was exposing health-related data.
Supabase is positioned similarly to firebase: you don't need a separate backend, and you access your database directly from the frontend. Security is dependent on relatively complicated rules in your database (simpler for firebase, a lot more involved for supabase with RLS)
This means it's a tool that is frequently reached for by newbies - the same sort of people who are the worst equipped to actually implement these complicated security rules themselves. With the advent of vibecoding, many people building are almost entirely dependent on the AI doing the right thing in every case. And this will get progressively more complicated to do correctly the more complicated the schema and usage patterns become.
I think we are in a territory where it is borderline irresponsible for supabase.