Guide Lovable and Bolt
Is my Lovable or Bolt app leaking data? How to tell in 15 minutes
Short answer
Your app leaks data when a stranger can read your users' records without logging in, or when one logged in user can read another user's records. On Lovable and Bolt, the common cause is a missing or too open access rule on a database table (Row Level Security, or RLS, in Supabase). A green "RLS enabled" label doesn't prove the rules are right; a rule that lets everyone through (a policy of using (true)) leaves the table open.
Three checks you can do today
- Open the Supabase Security Advisor and fix every error it lists.
- Sign out and see whether your app still shows private data.
- Make two test accounts and check whether account B can see account A's records.
Look for secret keys in your site's code
Look for a service_role or sb_secret_ key in your site's JavaScript. Those keys skip your access rules and must stay on a server. The public anon or publishable key is fine to show. More: Is my Supabase anon key exposed? You can also run our free check for exposed keys and missing security headers.
The Oct 30 Supabase change
Starting Oct 30, as the change reaches each existing project, new tables need access granted before your app can reach them. If you see error 42501 "permission denied for table" on a new table, that may be why. Existing tables keep their access, and your access rules (RLS) work the same. Details: Supabase Oct 30 grants change.
Where we can help
Free instant check: paste your URL at patchandship.com/check.html to scan your homepage's JavaScript for secret keys and security headers (no signup, nothing stored). Paid, fixed price per app: Database Check, $49; Security Fix, $149 (every critical issue on our checklist fixed within 48 hours of working access); Fix & Deploy, $249. Otherwise a full refund if you ask within 14 days of purchase (Refund Policy). AI agents run the checks and a human engineer approves every change. Not a penetration test or a security guarantee.
FAQ
Does "RLS enabled" mean my data is safe?
No. It means rules are switched on. A rule like using (true) still lets everyone read the table, so test signed out and with two accounts.
Is it a leak if my anon key is visible in the browser?
No. The anon or publishable key is meant to be public. A service_role or sb_secret_ key in the browser is a real leak.
Why do I get 42501 on a new table after Oct 30?
As Supabase's change reaches each existing project, new tables need access granted before the app can reach them, so a missing grant may be why. Existing tables keep their access.