Category · 15 advisories
App builders
Prompt-to-app platforms that generate and host whole apps.
Firebase Studio0Timeline · advisories per quarter
42025 Q1
12025 Q2
32025 Q3
22026 Q2
42026 Q3
12026 Q4
All advisories, worst first
01. Supabase RLS policies that check login but not ownershipA policy like using (auth.uid() is not null) has RLS on and mentions the user, so it passes Lovable’s scan. But it lets any logged-in user read every row, and on most apps anyone can sign up. 
Supabase 
Lovable 
Bolt +4 more 2026-10-10 02. UpGuard: 16,326 Supabase databases had readable tablesUpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens. Supabase 
Claude Code 
Codex CLI +4 more 2026-09-25 03. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt 
v0 +4 more 2026-08 04. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 05. Unverified Stripe webhooks hand out free upgradesIf your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps. 
Stripe Lovable Bolt +5 more 2026-05 06. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. 
Base44 2025-07 07. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 08. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. 
Next.js v0 Bolt +2 more 2025-03 09. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 10. Lovable bug exposed public projects’ code and AI chatsFrom 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report. Lovable 2026-04-20 11. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. 
MCP SDKs & servers Supabase 
Cursor +1 more 2025-07-08 12. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. 
Replit Cursor 2025-07 13. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 14. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code 
Copilot Cursor +5 more 2025 15. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03
Supabase Lovable Bolt +4 more 2026-10-10 02. UpGuard: 16,326 Supabase databases had readable tablesUpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens. Supabase Claude Code Codex CLI +4 more 2026-09-25 03. Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable Bolt v0 +4 more 2026-08 04. Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable Bolt v0 +4 more 2026-08 05. Unverified Stripe webhooks hand out free upgradesIf your Stripe webhook handler doesn’t verify the Stripe-Signature header, anyone can POST a fake “checkout.session.completed” event and your app will treat it as a real payment. Scans and audits find this in a large share of AI-built apps. Stripe Lovable Bolt +5 more 2026-05 06. Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 07. CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable Supabase 2025-05 08. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 09. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 10. Lovable bug exposed public projects’ code and AI chatsFrom 3 February to 20 April 2026, a Lovable permissions regression let any Lovable user with a project link read the source code and AI chat history of public projects. Lovable confirmed it and fixed it within two hours of the public report. Lovable 2026-04-20 11. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 12. AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit Cursor 2025-07 13. Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable Base44 Bolt +3 more 2025 14. Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Claude Code Copilot Cursor +5 more 2025 15. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03