Guides / Lovable Supabase RLS

Lovable app with Supabase: is your database open? (RLS check)

How to check if your Lovable app leaks Supabase tables because Row Level Security is off, and the exact prompt to fix it.

What it is

Lovable apps usually talk to Supabase straight from the browser using the public (anon or publishable) key. That key is meant to be public. What protects your data is Row Level Security (RLS): rules in the database that decide which rows each user can read or change. If RLS is off on a table, or a policy allows everyone, anyone who opens your app can copy the key from the page and read that table directly, including other users’ emails and private data.

How to check

1. Open your Supabase dashboard, go to Table Editor and look for tables marked as unrestricted or with RLS disabled.
2. In the SQL editor, run: select tablename, rowsecurity from pg_tables where schemaname = 'public'; Any row with false is unprotected.
3. Check policies that use using (true) on tables with personal data. That means every visitor can read every row.
4. Lovable also has built-in security scans; run them before you publish.
5. Or scan your live app from the outside with Cobalt Owl: we count readable rows without reading them.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

My Supabase tables may be readable by anyone with the public key. For every table in the public schema: enable Row Level Security, then add policies so signed-in users can only select, insert, update and delete their own rows (for example auth.uid() = user_id). Tables that must stay public should allow SELECT only on non-sensitive columns. Show me the SQL for each table and explain any table you think should stay public.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• Supabase: Row Level Security
• Supabase: Understanding API keys
• Lovable: Security overview

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.