Supabase security guides for AI-built apps

If you think something is wrong

Is my Lovable or Bolt app leaking data? How to tell in 15 minutes: How to tell if your Lovable or Bolt app is leaking data: run the Supabase Security Advisor, test signed out, test with two accounts and look for secret keys.
Can other people see my users' emails and data? (Lovable, Bolt and Supabase): In Lovable and Bolt apps the browser talks to Supabase directly, so a too-open profiles table shows everyone's data. Here's the two-account test and the fix.
How do I make an admin page only I can use? (Lovable and Bolt on Supabase): Hiding the admin button doesn't lock the admin page. Keep roles where users can't edit them, check the role in RLS, then test as a normal user.
Getting fake signups or bot accounts on your Lovable or Bolt app? How to stop them: Bots sign up by calling Supabase directly, skipping your form. Turn on CAPTCHA in Supabase Auth, require email confirmation and review Auth rate limits.
Think someone got into your Supabase database? What to do first (Lovable and Bolt apps): If someone may have got into your Supabase database: close open tables, rotate any exposed secret key, save your API and Auth logs, then decide who to tell.
Railway leak: which Supabase keys to rotate, and in what order: Railway says secrets stored in projects may have been read. For a Supabase app: new keys, redeploy, turn off the old keys, then a new database password.

Supabase errors and changes

What is Supabase's October 30 grants change, and will it break my app?: On Oct 30, 2026 Supabase stops auto-granting new public tables to the Data API on existing projects. Old tables keep working; new ones need a GRANT. Here's the fix.
Supabase error 42501 "permission denied for table": what it means and the safe fix: Error 42501 means your database blocked the request: an access rule or a missing grant. The safe fix for Supabase, Lovable and Bolt apps, with RLS kept on.
Supabase RLS policy examples for Lovable apps: Copy-paste Supabase RLS policies for Lovable, Bolt and Cursor apps: own rows, public read, contact forms, team members, admins and per-user storage folders.
Supabase RLS checklist for Lovable, Bolt and Cursor apps (free, CC BY 4.0): A free, citable Supabase RLS checklist for Lovable, Bolt and Cursor apps: seven checks with copy-ready SQL. Text CC BY 4.0, code MIT.
How do I fix Supabase RLS in a Lovable app?: Fix Supabase Row Level Security in a Lovable app: clear Security Advisor errors, add owner policies, test logged out, keep secret keys out of the frontend.
Is my Supabase storage bucket public? How to check and fix: Check whether your Supabase storage buckets are public, who can list files, and how to make private files private with policies and signed URLs.
Supabase "Function Search Path Mutable" warning: what it means and the safe fix: Security Advisor warns when a database function doesn't lock its search path. Set an empty search path and schema-qualify every table, then test the function.
Supabase emailed "Table publicly accessible": what it means and what to do before you launch: Supabase emailed "Table publicly accessible": a public table has RLS off. Anyone with your project URL can read, edit and delete that data until you fix it.
Supabase says "Security policy allows unrestricted access": what it means and what to do before you launch: Supabase WARN "Security policy allows unrestricted access" means an RLS policy uses always-true conditions. Fix private tables before launch.

Keys and secrets

My Supabase anon key is exposed in the frontend. Is that a problem?: The Supabase anon (or publishable) key is meant to be public. The real risk is weak RLS. Here's how to test what a stranger can read with it in 2 minutes.
Someone told me my Supabase key is exposed. What now?: It depends on the key. Publishable and anon keys are meant to be public. A secret or service_role key needs a new key and the old one turned off. Here's how.
My Supabase secret key is in my frontend. What now?: Found a Supabase secret or service_role key in your frontend or repo? It bypasses RLS. How to tell which key it is, rotate it, and stop it leaking again.
Where do I put the Supabase service role key vs the anon key in Lovable or Bolt?: Anon/publishable keys may live in the Lovable or Bolt browser app. Service role/secret keys stay server-side. Spot the wrong key in page source before launch.

Before you launch

Is my Lovable app safe to launch?: Run Lovable's free scans, check who can read your data and test with a second account. Plain steps for first-time makers, then where to get help.
Lovable security checklist: 8 checks before you publish: Pre-publish security run-through for Lovable apps: Deep scan, RLS policies, Secrets vs .env, storage, passwords, access settings and a logged-out test.
Is my Bolt app secure?: How to tell if a Bolt.new app is secure: run Bolt's free security audit, read the database Security tab, test with two accounts and look for keys in the bundle.
How do I secure a Replit app that uses Supabase?: Securing a Replit app on Supabase: keep keys in Replit Secrets, keep secret keys server-side, turn on RLS if the browser calls Supabase, and run Replit's scans.
How do I get Cursor to write safe Supabase RLS?: Make Cursor write safe Supabase RLS: a project rule for every migration, the Supabase MCP in read-only and project-scoped mode, and pgTAP tests that prove policies work.
How to check a Supabase app is safe before launch: A 7-step test you can run yourself: Security Advisor, a logged-out test, a two-account test, storage, your JavaScript bundle, and grants plus RLS.
The security scan keeps flagging the same issue after the fix. Why?: Lovable or Bolt keeps showing the same security warning after the AI fix? Rerun the scan, check whether the data is meant to be public, and test the result.
Vibe-Coded App Security Checklist: Lovable, Bolt, and Supabase (2026): A 12-step security checklist for Lovable, Bolt, Replit or Cursor apps on Supabase: RLS, keys, storage, auth URLs, webhooks and the Oct 30, 2026 grants change.
Three planted holes in a demo Supabase project, and what each check shows: We built a demo Supabase project, patchandship-demo, with fake data, planted three common security holes, and compared what each check reports.
Supabase leaked password protection warning: what it means and what to do: The leaked password warning means people can sign up with passwords from public breach lists. How to turn the check on in Supabase or Lovable Cloud, and what to do on Free.
Can users get your paid plan without paying? Stripe and plan settings in Lovable apps: They can if plan or credits live where users can edit them, or if a payment message isn't checked. Keep plan fields server-only and verify Stripe webhooks.
My Lovable or Supabase security scan looks clear. Do I still need someone to check before launch?: A clear Lovable or Supabase security scan helps, but it is not proof live access is correct. Built-in tools do not replace a thorough review before launch.
How to test your Lovable or Bolt app before real users (no SQL): Test your Lovable or Bolt app before real users with no SQL: signed-out and two-account click rituals, a light key glance, and when to get a second look.
Should I enable email confirmation before I launch my Lovable or Bolt app?: Turn Confirm Email on before a real Lovable or Bolt launch so new accounts prove the inbox. Off for throwaway tests; on for production.

Comparisons and deploys

Lovable vs Bolt: which is more secure?: Lovable vs Bolt security, from their own docs: what each built-in scan checks, what's free, and why RLS on your Supabase tables decides safety on both.
Lovable security audit options and prices (Oct 2026): This page lists the options we found that publicly offer this for Lovable, Bolt or Supabase apps, with each price exactly as the provider's page showed it the day we checked.
Vibe coding security audit: scanner, audit report or fixed-price fix?: Three ways to get a vibe-coded app checked: a scanner, an audit report or a fixed-price fix. What each one gives you, what it leaves to you, and our offer.
How do I deploy a Bolt app to a custom domain?: Deploy a Bolt app to your own domain: host, DNS, environment variables, the Vercel rewrite for Vite apps and the Supabase Site URL. Or Fix & Deploy for $249.
Moving from Lovable Cloud to your own Supabase: what to check so nothing breaks or leaks: How to move from Lovable Cloud to your own Supabase project: export first, what the export leaves out, Lovable's suggested order and the security checks after the move.