Scan of 512 Lovable app migrations finds widespread open Supabase write policies

A review of 512 public Lovable projects found that 16.2% include a migration policy letting signed-out visitors update or delete every row of a table. Another 1.4% expose the same write access to any signed-in user, and 10.4% create tables without enabling row level security. The authors examined the migration files the app builder shipped rather than querying live databases, and say they checked a sample of findings by hand and independently. Their tool, VibeRaven, is an open-source checker for Vercel and Supabase apps, and the analysis points to policies using a permissive true condition as a common cause.