A CVE on Lovable apps: the real cost of vibe coding

· Published · Updated · 1 min read

There is an official CVE on Lovable apps: missing data access rules, so anyone can read the database!

That is the real cost of vibe coding. The app works, the demo looks great… and the door is wide open.

And when security is not the problem, the AI has slowly built a house of cards that is impossible to maintain. Putting such an app back on solid ground is my day-to-day work.

What about asking the AI to audit itself?

No, that does not count. It is grading its own homework, haha.

I use AI a lot myself, but the whole point is knowing what to ask it, in which order, and checking what it gives back.

If your app runs on Supabase, here is the 2-minute check.

And once the app is secured, the work doesn’t stop at the first deploy.

Sources