Does Lovable expose API keys?

CVE-2025-48757 documented a critical vulnerability where Lovable-generated projects exposed Supabase service_role keys in client-side code. The service_role key bypasses all Row Level Security policies, giving anyone with the key full read and write access to the entire database. While Lovable has taken steps to address this, older projects and certain configurations may still be affected. UNPWNED specifically checks for exposed Supabase keys, Firebase credentials, and other secrets in your application code.