--- title: "Can Lovable apps be hacked?" description: "Can Lovable apps be hacked? Yes, usually through an open table or a leaked key, not a clever attack. Real incidents, the five ways in, and what to check." url: https://whocanfixmyapp.com/questions/can-lovable-apps-be-hacked --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / Question # Can Lovable apps be hacked? Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick answer Yes, and in most real cases nobody had to hack anything: someone opened a database table that was never locked, or found a secret key in the page code. The fix is access rules and key hygiene, not a firewall. - **Applies to**: Lovable - **Checks to run**: [DATA-01](https://whocanfixmyapp.com/checklist#DATA-01), [DATA-02](https://whocanfixmyapp.com/checklist#DATA-02), [AUTH-03](https://whocanfixmyapp.com/checklist#AUTH-03), [PAY-01](https://whocanfixmyapp.com/checklist#PAY-01), [DATA-05](https://whocanfixmyapp.com/checklist#DATA-05) When founders ask this, they usually picture a hacker breaking through a wall. For a Lovable app the wall is often not there. The browser talks to Supabase directly, so the only thing between a stranger and your customer list is the Row Level Security rule on each table. If Lovable wrote a loose rule, or no rule, the data is public. The same goes for a secret key that ended up in the front-end code. Anyone can read it with the browser's developer tools. This has happened at scale. In May 2025, researchers found 170 of 1,645 published Lovable projects with open tables, and reported seeing names, email addresses and API keys ([CVE-2025-48757](https://whocanfixmyapp.com/cve-2025-48757)). In April 2026, a researcher reported that chats and code on public Lovable projects could be read by any free account. Lovable said it did not suffer a data breach, that chats on public projects used to be visible, and that a change in February had accidentally re-enabled access to them. In May 2026, RedAccess reported about 5,000 AI-built apps on Lovable, Base44, Netlify and Replit exposing sensitive data, in part because projects defaulted to public. The ways a Lovable app actually gets broken into, in rough order: 1. A table without a working access rule. Anyone can read or change it. 2. A secret key in the page code. The Supabase secret key bypasses every access rule. A Stripe or OpenAI secret key lets someone spend your money. 3. A paid plan unlocked by the browser reaching a success page. Someone opens that page without paying. 4. No limit on sign-in or sign-up. Bots create thousands of accounts and run up your email and AI bills. 5. An admin screen that is hidden but not protected. The button is gone, the endpoint still answers. What to do on your own project, and only your own: - Run Lovable's Deep scan and read every finding. - Do the two-account test. Sign in as user A and try to open user B's record by changing the ID. - Search the live site's code for `sb_secret_`, `sk_live_`, `sk-proj-` and `service_role`. - If your project was ever public, or you pasted keys into the chat, treat those keys as exposed. Rotate them in Supabase, Stripe and your AI provider. - Add error monitoring so you hear about strange activity before a customer does. Money and time. A check or audit is $49–$800 and takes a day to a week. Single fixes are €99–$990 each. If you find open tables plus a leaked key, expect a cleanup at $1,500–$15,000 over one to eight weeks. See [pricing](https://whocanfixmyapp.com/pricing). Get help now if you find a secret key in the page code, if the two-account test shows another user's data, or if you already see accounts, charges or rows you did not create. [What to do after a data leak](https://whocanfixmyapp.com/data-leak) covers the first 24 hours. ## Check these DATA-01 · Critical Access rules are on for every table In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say `allow read, write: if true`. DATA-02 · Critical No secret keys reach the browser Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected. AUTH-03 · Medium Sign-in and sign-up are rate limited Without limits, bots create thousands of accounts and run up your email and AI bills. PAY-01 · Critical Paid accounts are unlocked by a verified payment webhook Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page. DATA-05 · High Admin actions are checked on the server Hiding an admin button is not protection. Call the admin endpoint as a normal user and confirm it is refused. ## Top-rated companies for Lovable apps Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 · Best for: A check before launch · Free first step · from $49 - 2 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 3 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 [All 59 Lovable companies, ranked](https://whocanfixmyapp.com/best/lovable-developers) ## Related questions ### I used Lovable before November 2025. Should I change my keys? If the project was public at any point, or you pasted a key into the chat, yes. Create new keys in Supabase, Stripe and your AI provider, put them in the project's secrets, and revoke the old ones. It takes under an hour and removes the doubt. ### Does Lovable Cloud make my app safer than my own Supabase? No. Lovable Cloud is Supabase run by Lovable, and the same access rules apply. The difference is that you cannot open the Supabase dashboard directly, so you review policies inside Lovable instead. Sources: [Semafor: Lovable is a sitting duck for hackers (May 2025)](https://www.semafor.com/article/05/29/2025/the-hottest-new-vibe-coding-startup-lovable-is-a-sitting-duck-for-hackers); [The Register: Lovable denies data leak (April 2026)](https://theregister.com/2026/04/20/lovable_denies_data_leak/); [Security Boulevard: Thousands of vibe-coded apps exposing data, RedAccess (May 2026)](https://securityboulevard.com/2026/05/thousands-of-vibe-coded-apps-exposing-corporate-personal-data-redaccess/); [Supabase docs: API keys](https://supabase.com/docs/guides/api/api-keys). **Related** - [Is my Lovable app safe?](https://whocanfixmyapp.com/questions/is-my-lovable-app-safe) - [Lovable app not working: what breaks between preview and production](https://whocanfixmyapp.com/problems/lovable-app-not-working) - [Lovable keeps saying it fixed the bug: how to get out of the loop without burning credits](https://whocanfixmyapp.com/problems/lovable-stuck-in-a-fix-loop) - [Hiring a Lovable developer: what to check before you pay](https://whocanfixmyapp.com/questions/hire-a-lovable-developer-what-to-check) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.