24,664 apps sending database rows to anyone who loads the page. Row-level security fixes this. A policy on every table decides which rows each user can see, and Postgres checks it on every query, from every client, including agents. Start from default-deny: a table with no policy
A security firm scanned 159,041 Lovable-built apps:
– 24,664 sent DB records on page load, no login
– 7,403 exposed tables with emails
– Worst: 1,000+ passport records, 200,000+ chats
AI ships the app in an hour. Row-level security still needs an owner. Who checks yours?
