Guide Supabase
Supabase leaked password protection warning: what it means and what to do
Short answer
The warning doesn't say anything leaked from your app. It means people can still sign up with a password that is already on public lists of leaked passwords, and attackers try those passwords first. Turn on the leaked password check and Supabase will reject those passwords. For Lovable's built in backend (Lovable Cloud), Lovable's docs call the same check "Password HIBP check" and list it next to settings for minimum length, required characters and signing in again before a password change.
What the check does
Supabase compares a new password against Have I Been Pwned, a public list of passwords known from past breaches, and rejects matches. Lovable describes it the same way: it blocks known or easy to guess passwords, and it calls it the most useful password setting because it stops the passwords attackers try first without making the rules harder for everyone.
Where to turn it on
- Lovable Cloud: Lovable's docs list a Password HIBP check under More, then Users, then Settings, then Email. If you don't see it there, check Lovable's docs for the current location or ask Lovable support. Meanwhile, set the minimum length and required characters.
- Your own Supabase project: the setting is in your project's Auth settings, with the other password rules. Afterwards, run the Security Advisor again to see if the warning is gone.
Why you may not be able to turn it on (your own Supabase project)
If you use your own Supabase project, leaked password protection is available on the Pro Plan and above. On the Free plan you can't turn it on, so the warning stays.
If you can't turn it on
On your own Supabase project on the Free plan, use the other password rules, which both Supabase and Lovable Cloud list:
- Set a longer minimum password length. Supabase doesn't recommend anything under 8 characters.
- Require a mix of characters, for example letters, numbers and symbols.
- Ask people to sign in again before they change their password.
Stricter rules add a little friction at sign up, so pick what fits your users. People whose old password falls short may be asked to change it when they sign in.
Check that it works
Try signing up in a test or staging copy of your app (or with a throwaway test email) using a password that's on public breach lists, such as password123. With the check on, sign up should be refused. Delete the test account afterwards. Don't test with a password you really use.
Want a second pair of eyes?
We check your Supabase setup and fix what we find. AI agents run the checks and a human engineer reviews and approves every report and change. It is not a penetration test, a security guarantee or a compliance certification.