Are Lovable Supabase tables secure by default?

No, Lovable-generated Supabase tables frequently lack proper Row Level Security (RLS) policies. When RLS is disabled or misconfigured, any authenticated user can read, modify, or delete data belonging to other users. Lovable may create tables with RLS enabled but without restrictive policies, which effectively leaves them open. This is one of the most common and dangerous vulnerabilities in Lovable applications. UNPWNED uses public client configuration for bounded anonymous-access tests and reports confirmed exposure; it does not parse or certify every RLS policy.