Can Lovable apps be hacked?

Yes, AI-generated code from Lovable often contains security vulnerabilities that attackers can exploit. Common issues include missing Row Level Security (RLS) on Supabase tables, exposed API keys in client-side code, and lack of input validation. Since Lovable generates full-stack applications rapidly, security best practices are frequently omitted in favor of functionality. UNPWNED checks externally observable secret-exposure, Supabase anonymous-access, and configuration signals. Complete RLS and input-validation correctness requires direct review.