• Root cause: the Supabase publishable (anon) key is designed to be public, so table access depends on Row Level Security policies. Many generated apps shipped without them or with policies that are too broad.
• Caveats (Crissy Field): email-bearing records may be public contacts or test data, and personal records without emails are missed; the sample is not representative of all Lovable apps; Lovable's own newer database features were not examined. The firm is not publishing access details.

If you built on Lovable/Supabase: log out, open your site, and with only the anon key try select on every table. Anything you can read is public. Enable RLS on every table, write policies scoped to auth.uid(), and never put admin-only data in tables the client queries. Supabase's security advisor in the dashboard flags tables with RLS turned off.