2026 Lovable — showcased EdTech app; ~18.7k user records exposed (Supabase access-control flaws)

In February 2026, The Register and independent researcher disclosures described a Lovable-hosted education application (not publicly named during coordinated disclosure) that allegedly exposed on the order of ~18,700 user rows—including roughly 14,900 unique emails—after an unauthenticated party could read or mutate Supabase-backed data due to missing or inverted row-level security and authentication guards. The reporting framed the issue as systemic “vibe coding” risk: AI-generated backends that appear functional but ship broken access control. Lovable told journalists it provides pre-publish security scans and that remediation is the project owner’s responsibility, while acknowledging contact with the app owner. This entry documents that public incident cluster; it is distinct from the separate CVE-2025-48757 / 170-app Supabase RLS class summarized under lovable2025 and from generic Supabase MCP tooling discussions.