Comment by slederer

We independently scanned 500+ Lovable-deployed apps as part of a larger study of 1,764 vibe-coded apps. The RLS problem is systemic — not a one-off. X% of Lovable apps we tested had wide-open Supabase tables where the anon key could read/write everything. The $6.6B question isn't whether the product is useful, it's whether the security liability of millions of deployed apps becomes a material risk. We published the full breakdown: securityscanner.dev/reports/2026-q2