What a Lovable RLS fix costs, and how to check yours first

A Lovable app with Row-Level Security (RLS) switched off costs $300 to $1,500 to fix at a fixed price with us, depending on how many tables there are and how tangled the queries are. Before you pay anyone, spend ten minutes checking it yourself. This page shows how.

Why this matters: CVE-2025-48757

Lovable uses Supabase as its default backend. The browser talks to Supabase with a public key that ships inside your app, and that is fine only if every table has RLS rules saying who may read and write which rows. In 2025 a security researcher disclosed CVE-2025-48757: Lovable-generated apps with missing RLS let unauthenticated visitors read or write database tables. In one scan, 170 of 1,645 apps were exposed.

Check yours in ten minutes

• Open your Supabase project and go to the table editor.
• Every table: is RLS enabled? If any table says it is off, that table is readable by anyone holding the public key.
• Every policy: does it limit rows to the signed-in user (for example, user_id = auth.uid()), or does it just say true?
• Storage buckets: are private files in a private bucket with its own policies?
• Service-role key: search your frontend code for it. It must never be in the browser.

Can you fix it yourself?

Sometimes. Switching RLS on is one click. The hard part is writing policies that lock the data down without breaking your own app's queries, because the moment RLS is on, every query that relied on open access starts returning nothing. If you try it yourself, do it on a copy of the database first, not on live users.

What the fix costs

• Single Fix, $300 to $1,500 fixed: RLS turned on and policies written and tested on every table, the service-role key moved server-side, and the queries that broke repaired.
• Fix Sprint, $3,500 to $6,000 fixed: when RLS is one of several must-fix items, alongside auth, payments and webhooks, secrets, backups, tests and error tracking.
• Either way, the price is fixed before we start, and it's 50% upfront and 50% on delivery.

We only check apps whose owner asks us to, with written permission. Send us yours and the free 48-hour verdict tells you, in writing, which tables are exposed and what the fix costs.