40% of Lovable apps expose database in browser

A passive scan of 15 public Lovable-built apps found 6 load their Supabase database client-side with public API keys, risking data exposure if Row-Level Security is misconfigured. Two audited apps leaked user data and paid content: one exposed password hashes, another gave away its entire paid catalogue without authentication. The author created a free tool, sealdy.dev, to help developers check for such leaks.