Free checklist · updated 8 October 2026
Did the Lovable leaks touch your app?
If you built your app with Lovable and it stores customer details, this is for you. You can run every check below yourself in the Supabase dashboard. None of them needs you to read code.
What happened
Lovable says that between 3 February and 20 April 2026, the chat history and source code of public projects could be opened by other Lovable users who had the project link (Lovable’s statement). Researchers reported that some of that code held database keys (The Next Web).
That is the platform side. The more common problem sits in the app itself. In February a researcher found an app featured on Lovable’s own showcase exposing 18,697 user records, and a 2025 sample found 170 of 1,645 Lovable apps let anyone read personal information, mostly because database rules were switched off (same source). Those are the gaps the checks below look for.
The seven checks
-
1. Find tables anyone can read
In Supabase, open Database → Advisors → Security Advisor. It lists tables that visitors can reach through your app’s public key with row level security switched off. That key ships to every visitor’s browser, so treat each table it lists as readable by anyone. If your project was created before June 2026, new tables are reachable this way by default until 30 October 2026, and the tables you already have stay reachable after that date. Supabase’s change only affects tables created later, so switch the rules on yourself.
-
2. Read each rule, not just the switch
A rule that says "true" lets everyone through. Look for rules on customer tables that do not mention auth.uid(). A rule should say who can read a row, usually "the person who created it".
-
3. Sign up a second account and try to see the first one’s data
Log in as a test user, open a page that shows your own record, and change the ID in the address bar to someone else’s. If their details appear, a customer can do the same.
-
4. Check your storage buckets
Storage → Buckets. A bucket marked Public serves its files to anyone with the link. Uploaded invoices, IDs or photos usually belong in a private bucket.
-
5. Rotate any secret that was ever in the chat or the code
The anon (public) key is meant to be visible. The service_role key, Stripe secret keys (sk_live_…), and email or AI API keys are not. If one was pasted into the Lovable chat or committed to the project, create a new one, update the app, then delete the old one.
-
6. Look at who read your data
Supabase keeps API and database logs, but only for as long as your plan allows: about a day on the free plan and up to a few weeks on paid plans. Scan what is there for large reads of customer tables from addresses you do not recognise. An empty log does not prove nobody looked, and anything older is gone unless you set up log exports earlier.
-
7. Work out whether you need to tell anyone
If customer personal information may have been seen by someone it should not have been, read the OAIC’s guide to responding to a data breach. Some small businesses are covered by the Notifiable Data Breaches scheme and some are not.
If something looks wrong
Fix the rule or rotate the key first, then check again with the second account. If you are not sure what a rule means, ask before you change it, because a rule that is too strict can lock your own customers out.
Found a table on that list, or saw someone else’s details? Email me what you saw, without any keys or passwords, and I’ll tell you what it means: hello@calvinkennedy.com.
If you would rather someone checked it
I’m Calvin, a software engineer in Newcastle, Australia. In an AI-built app check I read the database rules and the code, try the second-account test and the others for real, and send you each problem I could reproduce in the order to fix it, plus a list of what I did not check. The check starts from A$490, and if I find nothing worth fixing, you don’t pay. Read a sample report.
This checklist is general information about your own app. It is not legal advice, and it does not cover every way an app can leak data.