It’s Lovable using Supabase incorrectly, so Lovable is rightly to blame.
To add some nuance: Supabase’s security controls aren’t the simplest to work with and have been a source of confusion -- and data exposure -- for years. But Lovable markets its product specifically to people who, it claims, don’t need that technical knowledge. That sets the expectation that the user doesn't have to worry and that Lovable will get Supabase access controls right.
To add some nuance: Supabase’s security controls aren’t the simplest to work with and have been a source of confusion -- and data exposure -- for years. But Lovable markets its product specifically to people who, it claims, don’t need that technical knowledge. That sets the expectation that the user doesn't have to worry and that Lovable will get Supabase access controls right.