Can Lovable apps be hacked?

Yes, AI-generated code from Lovable often contains security vulnerabilities that attackers can exploit. Common issues include missing Row Level Security (RLS) on Supabase tables, exposed API keys in client-side code, and lack of input validation. Since Lovable generates full-stack applications rapidly, security best practices are frequently omitted in favor of functionality. UNPWNED scans Lovable apps for these exact vulnerabilities, checking for exposed secrets, missing RLS policies, and insecure configurations.