Are Lovable Supabase tables secure by default?

No, Lovable-generated Supabase tables frequently lack proper Row Level Security (RLS) policies. When RLS is disabled or misconfigured, any authenticated user can read, modify, or delete data belonging to other users. Lovable may create tables with RLS enabled but without restrictive policies, which effectively leaves them open. This is one of the most common and dangerous vulnerabilities in Lovable applications. UNPWNED scans your Supabase configuration to detect tables with missing or overly permissive RLS policies.