Kody Low

**Name of the Vulnerable Software and Affected Versions** Lovable versions prior to 2025-04-16 **Description** An insufficient database Row-Level Security (RLS) policy allows remote unauthenticated attackers to read from or write to arbitrary database tables of sites generated by the platform. Row-Level Security is a security feature that restricts which rows of data are returned in a query based on the user's identity. In affected applications, the RLS policy was either missing, misconfigured, or set to `USING (true)`, which effectively leaves the tables open to anyone possessing the public anonymous key. Real-world impact includes over 170 apps being exposed, with one specific instance resulting in the leak of 18,697 user records. Additionally, 303 insecure endpoints were identified as exposed. **Recommendations** For versions prior to 2025-04-16, review and properly configure the Row-Level Security policies in the associated Supabase databases to ensure data isolation and restrict unauthorized access to tables.