For Lovable, Bolt, Replit and Cursor apps
From $149. Within 48 hours of working access or a full refund.
Every change approved by a human engineer.
Three separate sources. Each measured something different, so read each one on its own and don't compare the numbers.
What Sentris measured: public GitHub repositories that use Supabase, meaning code, not live apps. August 2026.
Sentris scanned 2,144 public repositories that use Supabase, not live apps, and found a confirmed critical exposure in 40.6% of them.
Confirmed critical exposure, by builder (Sentris):
Lovable repos: 57.9%. Repos with no AI-tool marker: 24.9%.
What Symbiotic Security measured: live vibe‑coded sites that use Supabase, probed from the outside. June 2026.
In Symbiotic Security's scan of 1,072 vibe‑coded sites that use Supabase, 172 let anyone delete database records without authentication, 172 allowed unauthenticated PATCH (modification), 39 had tables fully readable with the public Supabase key, and 14 allowed unauthenticated inserts.
What this is: one vulnerability record, not a scan. It covers Lovable through April 2025.
CVSS 3.1 for CVE‑2025‑48757 (assigned by MITRE; disputed by Lovable), a Lovable RLS issue.
The security issues that AI app builders often leave behind: tables without Row Level Security, public storage of private files, secret keys in your app's code or repo, and secrets in public env variables. With Fix & Deploy we also point auth redirects at production and get the app live on your host with your domain and SSL. On Node/Express apps we also fix missing server-side access checks, open CORS and hard-coded secrets; these are fixed, but they are not "critical" for the 48-hour guarantee.
Yes. The anon (publishable) key is designed to be public. The risk is what sits behind it: a table without Row Level Security, or a secret service_role key shipped in your app's code. Supabase says a secret key bypasses every Row Level Security policy and must never be in a browser.
Usually because Row Level Security was never switched on. The app works in preview either way, so nobody notices. In Sentris's scan of public GitHub repositories, 57% of Lovable repos had a table in the public schema with Row Level Security switched off, compared with 21.7% of Supabase repos with no AI-tool marker. Sentris may become a referral partner.
Yes, with Fix & Deploy ($249). We deploy your app to Vercel or Netlify, or keep a Lovable or Replit app on that platform's own hosting with your domain. For Bolt apps, Fix & Deploy deploys to Vercel or Netlify. We don't deploy to Bolt's own hosting. We set the env variables on the host, point the Supabase auth Site URL and redirect URLs at production, connect your custom domain with SSL and smoke test login, signup and your main flow.
Security Fix is $149 and Fix & Deploy is $249, one time, for one app. Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase.
See prices and plans · How the refund guarantee works · Not sure? Get a free check
Recorded on practice apps we built, with demo data.
# 4. Same anon query after the fix. Expected: permission denied or empty.practice$ curl -s -w "\nHTTP %{http_code}\n" "http://127.0.0.1:54321/rest/v1/notes?select=id,title" -H "apikey: $TOKEN" -H "Authorization: Bearer $TOKEN"{"code":"42501","details":null,"hint":null,"message":"permission denied for table notes"}HTTP 401Signed in as Alice# 5. Signed-in Alice still sees her own notes (the app still works):practice$ curl -s "http://127.0.0.1:54321/rest/v1/notes?select=id,title" -H "apikey: $TOKEN" -H "Authorization: Bearer $TOKEN" | python3 -m json.tool[ { "id": 1, "title": "Alice private note" }, { "id": 2, "title": "Alice todo" }]# Done. Definition of done: anon cannot read; owners can.
Secure checkout by Stripe · Within 48 hours of working access or a full refund · Human‑approved changes
Secure checkout by Stripe · Within 48 hours of working access or a full refund · Human‑approved changes
Secure checkout by Stripe · Within 48 hours of working access or a full refund · Human‑approved changes
Launch posts, SEO copy and a directory list.
Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase. The Launch Pack is not covered. “Critical” and “live” are defined in our Refund Policy.
Per order: one app, one Supabase project, one deploy target. Apps with more than 25 user-defined tables are declined or quoted separately. No new features. Not a penetration test or compliance certification.
A passive check of your public homepage, its scripts and its security headers, and nothing else: we look for exposed secret keys, missing headers and publicly listed storage links. No database queries, no logins, no changes. One page, within 24 hours. Owners only.
Request my free checkLeast-privilege access only: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and at handoff you revoke our access (we send a checklist).
If we don't fix every critical issue on our checklist within 48 hours of working access (and, with Fix & Deploy, get your app live on your host), you get a full refund if you ask within 14 days of purchase. Details are in our Refund Policy.
Apps built with Lovable, Bolt, Replit or Cursor that use Supabase (or a Node/Express backend we can reach). Bolt and Cursor apps deploy to Vercel or Netlify. Lovable apps deploy to Vercel or Netlify, or stay on Lovable hosting. Replit apps stay on Replit hosting. Each order covers one app, one Supabase project (or one Node app) and one deploy target. Apps with more than 25 user-defined tables are declined or quoted separately. Custom backends and VPS/Docker setups are quoted separately.
Nothing touches production until a human engineer approves it. We take a backup before migrations when your plan supports it. On Supabase Free we give you a one-command dump to run, or skip schema changes until you upgrade.
No. It's a fixed-scope fix for common critical issues in AI-built apps. It isn't a penetration test, a security guarantee or a compliance certification.
No new features; we fix security issues and, with Fix & Deploy, get your existing app deployed.
No. The Supabase anon key (or the newer publishable key, sb_publishable_...) is designed to be public. Your data is protected by Row Level Security policies. The key that must never appear in frontend code is the service_role key (or the newer secret key, sb_secret_...), because it bypasses RLS. PatchAndShip checks the built bundle and git history for that key.
Check whether every table in the public schema has Row Level Security enabled with owner-scoped policies, then try reading each table with only the public key while logged out. PatchAndShip's paid plans run this test after the owner consents. On Lovable Cloud we run it when the project URL and public key are visible in the built app; otherwise we check the policies directly. The free mini check is passive: it looks only at the public homepage, its scripts and its security headers (for exposed secret keys, missing headers and publicly listed storage links), and nothing else: no database queries, no logins, no changes. It returns a one-page summary within 24 hours.
PatchAndShip charges a fixed $149 for the Security Fix (RLS, storage policies, key scan, rotation guidance) and $249 for Fix & Deploy, which adds production deploy, environment variables, auth redirect URLs, and custom domain with SSL. Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase.
Yes. The Fix & Deploy package ($249) deploys one app to Vercel or Netlify, or keeps a Lovable or Replit app on that platform's own hosting with your domain. For Bolt apps, Fix & Deploy deploys to Vercel or Netlify. We don't deploy to Bolt's own hosting. It sets environment variables, updates Supabase Site URL and Redirect URLs for the production domain, connects a custom domain with SSL, and smoke-tests login, signup, and the core flow.
From October 30, 2026, Supabase will stop exposing new tables in the public schema to the Data API (REST and GraphQL) on existing projects until you grant access. Existing tables keep working, and new projects have had this by default since May 30, 2026. Without a grant, the API returns error 42501 "permission denied for table". Our advice: grant only what each role needs, keep RLS on with policies, and never GRANT ALL to anon. If the grant is missing, Postgres rejects the query before RLS comes into play. And a grant without RLS exposes the table.
Scanners report problems. PatchAndShip fixes them: AI agents run the checks and draft the fixes as code changes and SQL migrations. If your project syncs to GitHub, they arrive as a pull request you can review. A human engineer reviews and approves every change before anything reaches production, and we re-run our checks afterwards.
48 hours from when working access (collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token) is confirmed.
Secure checkout by Stripe · Within 48 hours of working access or a full refund · Human‑approved changes
From $149. Within 48 hours of working access, or a full refund.
Secure checkout by Stripe · Within 48 hours of working access or a full refund · Human‑approved changes