---
title: Crissy Field: in 7,403 sampled Lovable-built sites, read-only requests with the public Supabase key returned records containing email addresses, and some apps exposed passports, payment data and chats | ctxsec
url: https://ctxsec.com/items/crissy-field-lovable-supabase-apps-unauthenticated-data-7403-sites
description: "German security firm Crissy Field used Common Crawl to find 159,041 apps built with the AI app builder Lovable (Dec 2025 to Sep 2026); 34,545 used Supabase. Of 24,664 sites that sent Supabase records on page load, extra read-only requests with the same public API key returned tables containing email addresses on 7,403 (30%). Worst cases included more than 1,000 passport records at one service provider, 80,000 forum profiles with 200,000 chat messages, ticket and food-order data with payment details, and 280,000 customer emails. The researchers could not establish whether any of the data was misused."
status: "official (Crissy Field GmbH research report, with Handelsblatt, Nov 2-3). The 30% figure is the researchers' own measure and, they say, not a confirmed leak rate"
published: 2026-11-03
---

> German security firm Crissy Field used Common Crawl to find 159,041 apps built with the AI app builder Lovable (Dec 2025 to Sep 2026); 34,545 used Supabase. Of 24,664 sites that sent Supabase records on page load, extra read-only requests with the same public API key returned tables containing email addresses on 7,403 (30%). Worst cases included more than 1,000 passport records at one service provider, 80,000 forum profiles with 200,000 chat messages, ticket and food-order data with payment details, and 280,000 customer emails. The researchers could not establish whether any of the data was misused.

[← AI](/ai) · [markdown](/items/crissy-field-lovable-supabase-apps-unauthenticated-data-7403-sites.md)

official (Crissy Field GmbH research report, with Handelsblatt, Nov 2-3). The 30% figure is the researchers' own measure and, they say, not a confirmed leak rate

2026-11-03

### Crissy Field: in 7,403 sampled Lovable-built sites, read-only requests with the public Supabase key returned records containing email addresses, and some apps exposed passports, payment data and chats

- **Root cause:** the Supabase publishable (anon) key is designed to be public, so table access depends on Row Level Security policies. Many generated apps shipped without them or with policies that are too broad.
- **Caveats (Crissy Field):** email-bearing records may be public contacts or test data, and personal records without emails are missed; the sample is not representative of all Lovable apps; Lovable's own newer database features were not examined. The firm is not publishing access details.

**If you built on Lovable/Supabase:** log out, open your site, and with only the anon key try `select` on every table. Anything you can read is public. Enable RLS on every table, write policies scoped to `auth.uid()`, and never put admin-only data in tables the client queries. Supabase's security advisor in the dashboard flags tables with RLS turned off.

Sources: [Crissy Field: Research Report – Lovable (English)](https://www.crissyfield.de/research/lovable-en/)